public class ForumFilter implements Filter {

    private static final String[] UNLOGIN_URIS = {"/index.jsp","/index.do","/login.jsp","/login/doLogin.do","/register.jsp",
                                                                "/register.do","/board/listBoardTopics-","/board/listTopicPosts-"};

    public void init(FilterConfig filterConfig) throws ServletException {

    }

    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {

         HttpServletRequest request = (HttpServletRequest) servletRequest;
         User user = getSessionUser(request);
         if (user==null && !isURILogin(request.getRequestURI(),request)){
             String toUrl = request.getRequestURI();
             if (!StringUtils.isEmpty(request.getQueryString())){
                  toUrl += "?" + request.getQueryString();
              }
              request.getSession().setAttribute(Define.LOGIN_TO_URL,toUrl);
              request.getRequestDispatcher("/login.jsp").forward(servletRequest,servletResponse);
              return;
          }
          filterChain.doFilter(servletRequest,servletResponse);
        }

    }
    protected User getSessionUser(HttpServletRequest request) {
        return (User) request.getSession().getAttribute(Define.UserLine);
    }

    public void destroy() {
    }

    protected boolean isURILogin(String requestURI,HttpServletRequest request){
        if (request.getContextPath().equalsIgnoreCase(requestURI)
                || (request.getContextPath() + "/").equalsIgnoreCase(requestURI))
            return true;
        for (String uri : UNLOGIN_URIS) {
            if (requestURI != null && requestURI.indexOf(uri) >= 0) {
                return true;
            }
        }
        return false;
    }
}

1. 實現Filter接口，重寫doFilter方法。

2. 將ServletRequest轉成HttpServletRequest並且獲取session中的用戶。

3. 如果存在用戶或者訪問的url是可以不登入就可訪問的，即已經登入成功了，那就直接doFilter()；

4. 如果不存在，那就保存當前要訪問的url，然後跳轉到登入界面，如果登入成功再跳回此url。

在一些應用中，未登錄用戶請求了必須登錄的資源時，提示用戶登錄，此時要記住用戶訪問的當前頁面的URL，當他登錄成功後根據記住的URL跳回用戶最後訪問的頁面：

String lastAccessUrl = request.getRequestURI() + "?" + request.getQueryString();

本文出自 “赤霄” 博客，請務必保留此出處http://cnslp.blog.51cto.com/11387491/1940184

使用Filter控制url訪問權限