跨站点请求伪造

最新推荐文章于 2020-04-09 21:19:16 发布

原创最新推荐文章于 2020-04-09 21:19:16 发布 · 131 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#xhtml

java 专栏收录该内容

2 篇文章

订阅专栏

写一个过滤器，下面是doFilter方法，代码如下：


HttpServletRequest request = (HttpServletRequest)req;
HttpServletRespone respone = (HttpServletRespone )res;
httpSession session = (HttpSession) request.getSession();

String referer = request.getHeader("Referer");
String basePath = request.getContextPath();

if (StringUtils.isEmpty(session.getAttribute("username")))
{
    if (request.getServletPath().indexOf("/loginExcute.xhtml") == -1)
    {
        req.getRequestDispatcher("/login.jsp").forword(req, respone);
    }
    else
    {
        if (refer != null && (referer.indexOf(basePath) != -1))
        {
            chain.doFilter(req,res);
        }
        else
        {
            req.getRequestDispatcher("/login.jsp").forward(req,respone);
        }
    }
}
else
{
    if (referer == null && (request.getServletPath().indexOf() != -1))
    {
        chain.doFiler(req, res);
    }
    else if (referer != null && (referer.indexOf(basePath) != -1))
    {
        chain.doFilter(req, res);
    }
    else
    {
        req.getRequestDispatcher("/login.jsp").forward(req, res);
    }
}