跨站点请求伪造

最新推荐文章于 2018-04-15 14:24:37 发布

请叫我f

最新推荐文章于 2018-04-15 14:24:37 发布

阅读量122

点赞数

分类专栏： java 文章标签： xhtml

本文链接：https://blog.youkuaiyun.com/jcicash/article/details/84493461

版权

java 专栏收录该内容

2 篇文章

订阅专栏

写一个过滤器，下面是doFilter方法，代码如下：


HttpServletRequest request = (HttpServletRequest)req;
HttpServletRespone respone = (HttpServletRespone )res;
httpSession session = (HttpSession) request.getSession();

String referer = request.getHeader("Referer");
String basePath = request.getContextPath();

if (StringUtils.isEmpty(session.getAttribute("username")))
{
    if (request.getServletPath().indexOf("/loginExcute.xhtml") == -1)
    {
        req.getRequestDispatcher("/login.jsp").forword(req, respone);
    }
    else
    {
        if (refer != null && (referer.indexOf(basePath) != -1))
        {
            chain.doFilter(req,res);
        }
        else
        {
            req.getRequestDispatcher("/login.jsp").forward(req,respone);
        }
    }
}
else
{
    if (referer == null && (request.getServletPath().indexOf() != -1))
    {
        chain.doFiler(req, res);
    }
    else if (referer != null && (referer.indexOf(basePath) != -1))
    {
        chain.doFilter(req, res);
    }
    else
    {
        req.getRequestDispatcher("/login.jsp").forward(req, res);
    }
}