public class AccessTokenFilter extends AbstractProcessor implements ActionFilter {
	
	private static final Log log = Logs.get();
	
	YvrService yvrService;

	public View match(ActionContext ac) {
		if (yvrService == null)
			yvrService = ac.getIoc().get(YvrService.class);
		HttpServletRequest req = ac.getRequest();
		String at = req.getParameter("accesstoken");
		if (req.getHeader("Api-Version") != null) {
			log.debug("api version = " + req.getHeader("Api-Version"));
			String loginname = req.getHeader("Api-Loginname");
			String nonce = req.getHeader("Api-Nonce");
			String key = req.getHeader("Api-Key");
			String time = req.getHeader("Api-Time");
			if (Strings.isBlank(loginname) || Strings.isBlank(nonce) || Strings.isBlank(key) || Strings.isBlank(time)) {
				return BaseModule.HTTP_403;
			}
			if (!yvrService.checkNonce(nonce, time)){
				return BaseModule.HTTP_403;
			}
			at = yvrService.accessToken(loginname);
			if (Strings.isBlank(at)) {
				return BaseModule.HTTP_403;
			}
			String tmp = Strings.join(",", at, loginname, nonce, time);
			String _key = Lang.sha1(tmp);
			log.debug("tmp="+tmp);
			log.debug("_key=" + _key);
			log.debug(" key=" + key);
			if (!_key.equals(key)) {
				return BaseModule.HTTP_403;
			}
			log.debug("api access token check ok");
		} 
		else if (Strings.isBlank(at)) { // TODO 移除这种兼容性,改成必须用nonce加密
			return BaseModule.HTTP_403;
		}
		int uid = yvrService.getUserByAccessToken(at);
		if (uid < 1) {
			return BaseModule.HTTP_403;
		}
		SecurityUtils.getSubject().getSession().setAttribute("me", uid);
		return null;
	}

@POST
	@At("/topics")
	@AdaptBy(type=WhaleAdaptor.class)
	@Filters(@By(type=AccessTokenFilter.class))
	public Object add(@Param("..")Topic topic, @Param("tab")String tab) {
		if (tab != null)
			topic.setType(TopicType.valueOf(tab));
		int userId = Toolkit.uid();
		CResult re = yvrService.add(topic, userId);
		if (re.isOk()) {
			return _map("success", true, "topic_id", re.as(String.class));
		} else {
			return _map("success", false, "message", re.getMsg());
		}
	}

@Filters(@By(type=AccessTokenFilter.class)) 这个过滤器的参数是 String at = req.getParameter("accesstoken"); 客户端里的每个web请求都需要把 accesstoken 字符串当做参数传入做验证？

如果 在客户端原生态登陆的时候调用 网页传递一个token，然后根据accesstoken检索账号，密码，然后做一次登陆设置session，这样，webview，是不是不用每次都传递accesstoken参数？