过滤器实现登录验证及拒绝直接输URL访问网页

package com.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class AuthFilter implements Filter {

public static final String LOGIN_PAGE = "/login.jsp";
public static final String LOGOUT_PAGE = "/Administrator/public/logout.jsp";
public static final String[] EXCEPT_PAGE = {"LoginCheck.jsp"};
public void destroy() {

}

public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse,
FilterChain filterChain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) servletRequest;
/**
* 如果处理HTTP请求，并且需要访问诸如getHeader或getCookies等在ServletRequest中
* 无法得到的方法，就要把此request对象构造成HttpServletRequest
*/
HttpServletResponse response = (HttpServletResponse) servletResponse;

String currentURL = request.getRequestURI(); // 取得根目录所对应的绝对路径:

HttpSession session = request.getSession(false);

boolean bool = false;
for (int i = 0; i< EXCEPT_PAGE.length; i++){
if (currentURL.indexOf(EXCEPT_PAGE[i])>=0){
bool = true;
break;
}
}
if (currentURL.indexOf(LOGIN_PAGE) == -1 && currentURL.indexOf(LOGOUT_PAGE) == -1 && currentURL.indexOf(".jsp") > -1 && !bool) {
// 判断当前页是否是重定向以后的登录页面，如果是就不做session的判断，防止出现死循环
String ref = request.getHeader("REFERER"); //是否是从地址栏直接输入的地址吗？
if (session == null || session.getAttribute("USERNAME") == null || session.getAttribute("USERNAME").equals("") || (ref==null) || (ref.equals(""))) {
response.sendRedirect(request.getContextPath()
+ LOGOUT_PAGE);
return;
}
}
// 加入filter链继续向下执行
filterChain.doFilter(request, response);
}

public void init(FilterConfig arg0) throws ServletException {

}

}

-------------------------------------------------------------------------------------------------------

web.xml中设置如下:

<!-- Login Check begin -->
<filter>
<filter-name>AuthFilter</filter-name>
<filter-class>com.filter.AuthFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>AuthFilter</filter-name>
<url-pattern>/Administrator/*</url-pattern>
</filter-mapping>

<!-- Login Check end-->