chklogin.jsp:
<%@ page language="java" pageEncoding="GBK" import="news.admin.*"%>
<!DOCTYPE HTML PUBLIC "-//w3c//dtd html 4.0 transitional//en">
<html>
<head>
<title>Lomboz JSP</title>
</head>
<body bgcolor="#FFFFFF">
<%
String username = request.getParameter("username");
String password = request.getParameter("password");
CheckManagers checkManagers = new CheckManagers();
//查询数据库，验证用户名和密码
if (!checkManagers.checkLogin(username, password)) {
%>
username or password may be incorrect. Please go back.<br>
<a href="index.jsp">Return to admin entrance</a>
<%
} else {
//用登陆名标示Session。
session.setAttribute("UNIQUE_CHECK_STRING", username);
response.sendRedirect("main.jsp");
}
%>
</body>
</html>
session-guard.jsp:
<%@ page language="java" pageEncoding="GBK" %>
<%
String uniqueCheckString = (String)session.getAttribute("UNIQUE_CHECK_STRING");
if (uniqueCheckString == null) {
//销毁当前Session
session.invalidate();
//重定向到WEB应用的首页。转到首页后，服务器会自动创建一个新的Session。这个新的Session不含登陆名标示,无法访问受限页面。
response.sendRedirect(request.getContextPath() + "/index.jsp");
}
%>
main.jsp:
//在任何需要保护的JSP页面中加入这一行:
<%@ include file="/admin/session-guard.jsp" %>