Interceptor(권한) 구현

권한 구현이라고 작성하긴했지만 완벽한 권한을 제한할 수있는 것은 아님.

UrlMapping을 할 때 /admin이 붙어있는 주소에는 memberType이 ADMIN인 사람만 접근할 수 있는 기능을 구현하기 위함이다.

 

1. 설정 파일 생성.

package com.example.bravobra.config;


import lombok.RequiredArgsConstructor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
@RequiredArgsConstructor
public class WebConfig implements WebMvcConfigurer {

    private final AdminInterceptor adminInterceptor;

    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(adminInterceptor)
                .addPathPatterns("/admin/**");
    }
}

 

2. interceptor 구현.

package com.example.bravobra.config;

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import jakarta.servlet.http.HttpSession;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;

@Component
public class AdminInterceptor  implements HandlerInterceptor {

    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        HttpSession session = request.getSession(false);

        if(session == null || !"ADMIN".equals(session.getAttribute("memberType"))){
            response.sendRedirect("/errorAccess");
            return false;
        }

        return true;
    }

}