jsp权限管理

@WebFilter("/secure/*")
public class AuthFilter implements Filter {
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse res = (HttpServletResponse) response;
        
        HttpSession session = req.getSession(false);
        if (session == null || session.getAttribute("user") == null) {
            res.sendRedirect(req.getContextPath() + "/login.jsp");
        } else {
            chain.doFilter(request, response);
        }
    }
    // 其他方法省略...
}

public class User {
    private String username;
    private Set<String> roles;

    // Getters and setters
}

public class PermissionChecker {
    public boolean hasPermission(User user, String requiredRole) {
        return user.getRoles().contains(requiredRole);
    }
}

@WebServlet("/admin")
public class AdminServlet extends HttpServlet {
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        HttpSession session = request.getSession(false);
        User user = (User) session.getAttribute("user");
        
        if (user != null && new PermissionChecker().hasPermission(user, "admin")) {
            request.getRequestDispatcher("/admin.jsp").forward(request, response);
        } else {
            response.sendRedirect(request.getContextPath() + "/accessDenied.jsp");
        }
    }
}