基于拦截器的用户权限管理的分析与设计  

The Analysis and Design of the User Powers Management based on Interceptor

作　　者：杨光豹[1] 

机构地区：[1]浙江广播电视大学青田学院,浙江青田323900

出　　处：《计算机安全》2014年第2期14-20,共7页Network & Computer Security

摘　　要：企业级web系统的应用在当前已经成为一种主流,而在传统Web系统中,用户的权限一般是按功能模块来进行粗粒度分配,缺少灵活性,不能做到"量身定制"。对于具有多种角色权限的用户来说,使用系统时会带来诸多不便。另外,由于系统只对用户进行登录验证,这也会给系统带来安全隐患。为了改进上述缺陷,提出利用Struts2、Spring3、Hibernate4等三大软件包进行整合开发Web系统,通过权限管理拦截器对每个用户请求进行登录验证与权限验证,使系统能够采用细粒度管理用户权限,增强权限管理的灵活性。The enterprise web application system has been ＆ main trend at present. The power of user is used the basis of the function module of？system in traditional methods. It lacks flexibility ＆nd cannot Made to Measure to be assigned on It makes it very inconvenient for the user who has multiple roles in using the web application system. Furthermore, Permission Validation is performed only at log in, it will bring potential safety hazard to the system. To improve the above- mentioned defect, this thesis puts forward methods of developing web system by integrating frameworks of Struts2, Spring5 and Hibernate4. It validates the log--in and visit permission for every request by means of the visit permission interceptor. In this way, the web system can control user powers in fine grain and Enhance security of system .

关 键 词：STRUTS2 SPRING HIBERNATE 框架整合 拦截器 

分 类 号：TP311.13[自动化与计算机技术—计算机软件与理论]