<!-- 攔截器 -->
	<mvc:interceptors>
	    <mvc:interceptor>
		   	<!-- 用戶認證攔截 -->
		   	<mvc:mapping path="/**"/>
		   	<bean class="liuxun.ssm.controller.interceptor.LoginInterceptor"></bean>
	    </mvc:interceptor>
	</mvc:interceptors>

//根據(jù)用戶id查詢權(quán)限URL
	public List<SysPermission> findPermissionListByUserId(String userid) throws Exception;

@Override
	public List<SysPermission> findPermissionListByUserId(String userid) throws Exception {
		return sysPermissionMapperCustom.findPermissionListByUserId(userid);
	}

用戶認證通過后取出菜單和URL放入Session

//得到用戶id
		String userid = sysUser.getId();
		//根據(jù)用戶id查詢菜單
		List<SysPermission> menus = this.findMenuListByUserId(userid);
		//根據(jù)用戶id查詢權(quán)限url
		List<SysPermission> permissions = this.findPermissionListByUserId(userid);
		//認證通過，返回用戶身份信息
		ActiveUser activeUser = new ActiveUser();
		activeUser.setUserid(userid);
		activeUser.setUsercode(usercode);
		activeUser.setUsername(sysUser.getUsername());
        //放入權(quán)限范圍的菜單和url
		activeUser.setMenus(menus);
		activeUser.setPermissions(permissions);

菜單動態(tài)顯示

<c:if test="${activeUser.menus!=null }">
				<ul>
				<c:forEach items="${activeUser.menus }" var="menu">
					<li><div>
						<a title="${menu.name }" ref="1_1" href="#"
							rel="${baseurl }/${menu.url }" icon="icon-log"><span
							class="icon icon-log"> </span><span class="nav"><a href=javascript:addTab('${menu.name }','${baseurl }/${menu.url }')>${menu.name }</a></span></a>
					</div></li>
				</c:forEach>
				</ul>
			</c:if>

授權(quán)攔截器

public class PermissionInterceptor implements HandlerInterceptor{
	//在執(zhí)行handler之前執(zhí)行的
	//用于用戶認證校驗、用戶權(quán)限校驗
	@Override
	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
		//得到請求的url
		String url = request.getRequestURI();
		//判斷是否是公開地址
		//實際開發(fā)中需要將公開地址配置在配置文件中
		//從配置文件中取出可以匿名訪問的URL
		List<String> open_urls = ResourcesUtil.getKeyList("anonymousURL");
		for (String open_url : open_urls) {
			if (url.indexOf(open_url)>=0) {
				//如果是公開地址 則放行
				return true;
			}
		}
		//從配置文件中獲取公用訪問url
		List<String> common_urls = ResourcesUtil.getKeyList("commonURL");
		//遍歷公用地址 如果是公開地址則放行
		for (String common_url : common_urls) {
			if (url.indexOf(common_url)>0) {
				//如果是公開，則放行
				return true;
			}
		}
		//判斷用戶身份在Session中是否存在
		HttpSession session = request.getSession();
		ActiveUser activeUser = (ActiveUser) session.getAttribute("activeUser");
		//從Session中取出權(quán)限范圍的URL
		List<SysPermission> permissions = activeUser.getPermissions();
		for (SysPermission sysPermission : permissions) {
			//權(quán)限url
			String permission_url = sysPermission.getUrl();
			if (url.indexOf(permission_url)>0) {
				return true;
			}
		}
		//執(zhí)行到這里攔截，跳轉(zhuǎn)到無權(quán)訪問的提示頁面
		request.getRequestDispatcher("/WEB-INF/jsp/refuse.jsp").forward(request, response);
		//如果返回false表示攔截器不繼續(xù)執(zhí)行handler，如果返回true表示放行
		return false;
	}
   ......
}

配置授權(quán)攔截器

<!-- 攔截器 -->
	<mvc:interceptors>
	    <mvc:interceptor>
		   	<!-- 用戶認證攔截 -->
		   	<mvc:mapping path="/**"/>
		   	<bean class="liuxun.ssm.controller.interceptor.LoginInterceptor"></bean>
	    </mvc:interceptor>
	    <mvc:interceptor>
	    	<!-- 資源攔截 -->
	    	<mvc:mapping path="/**"/>
	    	<bean class="liuxun.ssm.controller.interceptor.PermissionInterceptor"></bean>
	    </mvc:interceptor>
	</mvc:interceptors>

package liuxun.ssm.po;
import java.io.Serializable;
import java.util.List;
/**
 * 用戶身份信息，存入Session  由于Tomcat正常關(guān)閉時會將Session序列化的本地硬盤上，所以實現(xiàn)Serializable接口
 * @author liuxun
 *
 */
public class ActiveUser implements Serializable {
	private static final long serialVersionUID = 1L;
	private String userid; //用戶id(主鍵)
	private String usercode; // 用戶賬號
	private String username; // 用戶姓名
	private List<SysPermission> menus; //菜單
	private List<SysPermission> permissions; //權(quán)限
    // 提供對應setter和getter方法
    ......
}

package liuxun.ssm.mapper;
import java.util.List;
import liuxun.ssm.po.SysPermission;
import liuxun.ssm.po.SysPermissionExample;
import org.apache.ibatis.annotations.Param;
/**
 * 權(quán)限mapper
 * @author liuxun
 *
 */
public interface SysPermissionMapperCustom {
    //根據(jù)用戶id查詢菜單
	public List<SysPermission> findMenuListByUserId(String userid) throws Exception;
	//根據(jù)用戶id查詢權(quán)限URL
	public List<SysPermission> findPermissionListByUserId(String userid) throws Exception;
}

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-////DTD Mapper 3.0//EN" "http:///dtd/mybatis-3-mapper.dtd" >
<mapper namespace="liuxun.ssm.mapper.SysPermissionMapperCustom">
<!-- 根據(jù)用戶id查詢菜單 -->
<select id="findMenuListByUserId" parameterType="string" resultType="liuxun.ssm.po.SysPermission">
   SELECT 
	  * 
	FROM
	  sys_permission 
	WHERE TYPE = 'menu' 
	  AND id IN 
	  (SELECT 
	    sys_permission_id 
	  FROM
	    sys_role_permission 
	  WHERE sys_role_id IN 
	    (SELECT 
	      sys_role_id 
	    FROM
	      sys_user_role 
	    WHERE sys_user_id = #{userid}))
</select>
<!-- 根據(jù)用戶id查詢URL -->
<select id="findPermissionListByUserId" parameterType="string" resultType="liuxun.ssm.po.SysPermission">
   SELECT 
	  * 
	FROM
	  sys_permission 
	WHERE TYPE = 'permission' 
	  AND id IN 
	  (SELECT 
	    sys_permission_id 
	  FROM
	    sys_role_permission 
	  WHERE sys_role_id IN 
	    (SELECT 
	      sys_role_id 
	    FROM
	      sys_user_role 
	    WHERE sys_user_id = #{userid}))
</select>
</mapper>

package liuxun.ssm.service;
import java.util.List;
import liuxun.ssm.po.ActiveUser;
import liuxun.ssm.po.SysPermission;
import liuxun.ssm.po.SysUser;
/**
 * 認證授權(quán)服務接口
 * @author liuxun
 *
 */
public interface SysService {
	//根據(jù)用戶的身份和密碼進行認證，如果認證通過，返回用戶身份信息
	public ActiveUser authenticat(String usercode,String password) throws Exception;
	//根據(jù)用戶賬號查詢用戶信息
	public SysUser findSysUserByUserCode(String userCode) throws Exception;
	//根據(jù)用戶id查詢權(quán)限范圍內(nèi)的菜單
	public List<SysPermission> findMenuListByUserId(String userid) throws Exception;
	//根據(jù)用戶id查詢權(quán)限范圍內(nèi)的url
	public List<SysPermission> findPermissionListByUserId(String userid) throws Exception;
}

package liuxun.ssm.service.impl;
import java.util.List;
import org.springframework.beans.factory.annotation.Autowired;
import liuxun.ssm.exception.CustomException;
import liuxun.ssm.mapper.SysPermissionMapperCustom;
import liuxun.ssm.mapper.SysUserMapper;
import liuxun.ssm.po.ActiveUser;
import liuxun.ssm.po.SysPermission;
import liuxun.ssm.po.SysUser;
import liuxun.ssm.po.SysUserExample;
import liuxun.ssm.service.SysService;
import liuxun.ssm.util.MD5;
public class SysServiceImpl implements SysService {
	@Autowired
	private SysUserMapper sysUserMapper;
	@Autowired
	private SysPermissionMapperCustom sysPermissionMapperCustom;
	public ActiveUser authenticat(String usercode, String password) throws Exception {
		/**
		 * 認證過程： 根據(jù)用戶身份(賬號)查詢數(shù)據(jù)庫，如果查詢不到則用戶不存在 
		 * 對輸入的密碼和數(shù)據(jù)庫密碼進行比對，如果一致則認證通過
		 */
		// 根據(jù)用戶賬號查詢數(shù)據(jù)庫
		SysUser sysUser = this.findSysUserByUserCode(usercode);
		if (sysUser == null) {
			// 拋出異常
			throw new CustomException("用戶賬號不存在");
		}
		// 數(shù)據(jù)庫密碼（MD5加密后的密碼）
		String password_db = sysUser.getPassword();
		// 對輸入的密碼和數(shù)據(jù)庫密碼進行比對，如果一致，認證通過
		// 對頁面輸入的密碼進行MD5加密
		String password_input_md5 = new MD5().getMD5ofStr(password);
		if (!password_db.equalsIgnoreCase(password_input_md5)) {
			//拋出異常
			throw new CustomException("用戶名或密碼錯誤");
		}
		//得到用戶id
		String userid = sysUser.getId();
		//根據(jù)用戶id查詢菜單
		List<SysPermission> menus = this.findMenuListByUserId(userid);
		//根據(jù)用戶id查詢權(quán)限url
		List<SysPermission> permissions = this.findPermissionListByUserId(userid);
		//認證通過，返回用戶身份信息
		ActiveUser activeUser = new ActiveUser();
		activeUser.setUserid(userid);
		activeUser.setUsercode(usercode);
		activeUser.setUsername(sysUser.getUsername());
        //放入權(quán)限范圍的菜單和url
		activeUser.setMenus(menus);
		activeUser.setPermissions(permissions);
		return activeUser;
	}
	public SysUser findSysUserByUserCode(String userCode) throws Exception {
		SysUserExample sysUserExample = new SysUserExample();
		SysUserExample.Criteria criteria = sysUserExample.createCriteria();
		criteria.andUsercodeEqualTo(userCode);
		List<SysUser> list = sysUserMapper.selectByExample(sysUserExample);
		if (list != null && list.size() > 0) {
			return list.get(0);
		}
		return null;
	}
	@Override
	public List<SysPermission> findMenuListByUserId(String userid) throws Exception {
		return sysPermissionMapperCustom.findMenuListByUserId(userid);
	}
	@Override
	public List<SysPermission> findPermissionListByUserId(String userid) throws Exception {
		return sysPermissionMapperCustom.findPermissionListByUserId(userid);
	}
}

package liuxun.ssm.controller;
import javax.servlet.http.HttpSession;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import liuxun.ssm.exception.CustomException;
import liuxun.ssm.po.ActiveUser;
import liuxun.ssm.service.SysService;
/**
 * 登錄和退出
 * @author liuxun
 *
 */
@Controller
public class LoginController {
    @Autowired
    private SysService sysService;
	//用戶登錄提交方法
	@RequestMapping("/login")
	public String login(HttpSession session,String randomcode,String usercode,String password) throws Exception{
		// 校驗驗證碼，防止惡性攻擊
		// 從Session中獲取正確的驗證碼
		String validateCode = (String) session.getAttribute("validateCode");
		//輸入的驗證碼和Session中的驗證碼進行對比
		if (!randomcode.equalsIgnoreCase(validateCode)) {
			//拋出異常
			throw new CustomException("驗證碼輸入錯誤");
		}
		//調(diào)用Service校驗用戶賬號和密碼的正確性
		ActiveUser activeUser = sysService.authenticat(usercode, password);
		//如果Service校驗通過，將用戶身份記錄到Session
		session.setAttribute("activeUser", activeUser);
		//重定向到商品查詢頁面
		return "redirect:/first.action";
	}
	//用戶退出
	@RequestMapping("/logout")
	public String logout(HttpSession session) throws Exception{
		//session失效
		session.invalidate();
		//重定向到商品查詢頁面
		return "redirect:/first.action";
	}
}

package liuxun.ssm.controller.interceptor;
import java.util.List;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;
import liuxun.ssm.po.ActiveUser;
import liuxun.ssm.util.ResourcesUtil;
/**
 * 測試攔截器1
 * @author liuxun
 *
 */
public class LoginInterceptor implements HandlerInterceptor{
	//在執(zhí)行handler之前執(zhí)行的
	//用于用戶認證校驗、用戶權(quán)限校驗
	@Override
	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
		//得到請求的url
		String url = request.getRequestURI();
		//判斷是否是公開地址
		//實際開發(fā)中需要將公開地址配置在配置文件中
		//從配置文件中取出可以匿名訪問的URL
		List<String> open_urls = ResourcesUtil.getKeyList("anonymousURL");
		for (String open_url : open_urls) {
			if (url.indexOf(open_url)>=0) {
				//如果是公開地址 則放行
				return true;
			}
		}
		//判斷用戶身份在Session中是否存在
		HttpSession session = request.getSession();
		ActiveUser activeUser = (ActiveUser) session.getAttribute("activeUser");
		//如果用戶身份在session中存在則放行
		if (activeUser!=null) {
			return true;
		}
		//執(zhí)行到這里攔截，跳轉(zhuǎn)到登錄頁面，用戶進行身份認證
		request.getRequestDispatcher("/WEB-INF/jsp/login.jsp").forward(request, response);
		//如果返回false表示攔截器不繼續(xù)執(zhí)行handler，如果返回true表示放行
		return false;
	}
	//在執(zhí)行handler返回modelAndView之前執(zhí)行
	//如果需要向頁面提供一些公用的數(shù)據(jù)或配置一些視圖信息，使用此方法實現(xiàn) 從modelAndView入手
	@Override
	public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView)
			throws Exception {
		System.out.println("HandlerInterceptor2...postHandle");
	}
	//執(zhí)行handler之后執(zhí)行此方法
	//作為系統(tǒng)統(tǒng)一異常處理，進行方法執(zhí)行性能監(jiān)控，在preHandler中設置一個時間點 在afterCompletion設置一個時間點 二者時間差就是執(zhí)行時長
	//實現(xiàn)系統(tǒng)，統(tǒng)一日志記錄
	@Override
	public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception modelAndView)
			throws Exception {
		System.out.println("HandlerInterceptor2...afterCompletion");
	}
}

package liuxun.ssm.controller.interceptor;
import java.security.acl.Permission;
import java.util.List;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;
import liuxun.ssm.po.ActiveUser;
import liuxun.ssm.po.SysPermission;
import liuxun.ssm.util.ResourcesUtil;
/**
 * 授權(quán)攔截器
 * @author liuxun
 *
 */
public class PermissionInterceptor implements HandlerInterceptor{
	//在執(zhí)行handler之前執(zhí)行的
	//用于用戶認證校驗、用戶權(quán)限校驗
	@Override
	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
		//得到請求的url
		String url = request.getRequestURI();
		//判斷是否是公開地址
		//實際開發(fā)中需要將公開地址配置在配置文件中
		//從配置文件中取出可以匿名訪問的URL
		List<String> open_urls = ResourcesUtil.getKeyList("anonymousURL");
		for (String open_url : open_urls) {
			if (url.indexOf(open_url)>=0) {
				//如果是公開地址 則放行
				return true;
			}
		}
		//從配置文件中獲取公用訪問url
		List<String> common_urls = ResourcesUtil.getKeyList("commonURL");
		//遍歷公用地址 如果是公開地址則放行
		for (String common_url : common_urls) {
			if (url.indexOf(common_url)>0) {
				//如果是公開，則放行
				return true;
			}
		}
		//判斷用戶身份在Session中是否存在
		HttpSession session = request.getSession();
		ActiveUser activeUser = (ActiveUser) session.getAttribute("activeUser");
		//從Session中取出權(quán)限范圍的URL
		List<SysPermission> permissions = activeUser.getPermissions();
		for (SysPermission sysPermission : permissions) {
			//權(quán)限url
			String permission_url = sysPermission.getUrl();
			if (url.indexOf(permission_url)>0) {
				return true;
			}
		}
		//執(zhí)行到這里攔截，跳轉(zhuǎn)到無權(quán)訪問的提示頁面
		request.getRequestDispatcher("/WEB-INF/jsp/refuse.jsp").forward(request, response);
		//如果返回false表示攔截器不繼續(xù)執(zhí)行handler，如果返回true表示放行
		return false;
	}
	//在執(zhí)行handler返回modelAndView之前執(zhí)行
	//如果需要向頁面提供一些公用的數(shù)據(jù)或配置一些視圖信息，使用此方法實現(xiàn) 從modelAndView入手
	@Override
	public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView)
			throws Exception {
		System.out.println("HandlerInterceptor2...postHandle");
	}
	//執(zhí)行handler之后執(zhí)行此方法
	//作為系統(tǒng)統(tǒng)一異常處理，進行方法執(zhí)行性能監(jiān)控，在preHandler中設置一個時間點 在afterCompletion設置一個時間點 二者時間差就是執(zhí)行時長
	//實現(xiàn)系統(tǒng)，統(tǒng)一日志記錄
	@Override
	public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception modelAndView)
			throws Exception {
		System.out.println("HandlerInterceptor2...afterCompletion");
	}
}

<!-- 攔截器 -->
	<mvc:interceptors>
	    <mvc:interceptor>
		   	<!-- 用戶認證攔截 -->
		   	<mvc:mapping path="/**"/>
		   	<bean class="liuxun.ssm.controller.interceptor.LoginInterceptor"></bean>
	    </mvc:interceptor>
	    <mvc:interceptor>
	    	<!-- 資源攔截 -->
	    	<mvc:mapping path="/**"/>
	    	<bean class="liuxun.ssm.controller.interceptor.PermissionInterceptor"></bean>
	    </mvc:interceptor>
	</mvc:interceptors>