Token实现防重放

最新推荐文章于 2025-03-29 08:45:03 发布

「已注销」

最新推荐文章于 2025-03-29 08:45:03 发布

阅读量7.9k

点赞数

分类专栏： java 安全基础

本文链接：https://blog.youkuaiyun.com/yu670538949/article/details/52678803

版权

基础同时被 3 个专栏收录

9 篇文章

订阅专栏

java

6 篇文章

订阅专栏

安全

2 篇文章

订阅专栏

本文介绍了使用Token防止请求重放的代码实现，包括Token类的设计和后台逻辑的校验方法，业务逻辑只需将请求传给TokenManager进行校验。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

本文主要内容是使用token防重放的代码实现。

1. Token类

package com.bean;

public class Token {
	public static final String DEFAULT_TOKEN_NAME = "token";
	
	private final String tokenName;

	private final String tokenValue;

	public Token(String tokenName,String tokenValue){
		this.tokenName = tokenName;
		this.tokenValue = tokenValue;
	}
	public String getTokenName() {
		return tokenName;
	}

	public String getTokenValue() {
		return tokenValue;
	}
}

2. TokenManager

package com.util;

import java.util.UUID;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;

import org.apache.commons.lang.StringUtils;

import com.bean.Token;

public class TokenManager {

	public static final String SESSION_TOKEN_KEY = "$SESSIONTOKEN";
	 
	public static String generateToken(){
		return UUID.randomUUID().toString();
	}
	
	public static boolean validToken(HttpServletRequest httpServletRequest){
		HttpSession httpSession = httpServletRequest.getSession();
		Token token = (Token) httpSession.getAttribute(SESSION_TOKEN_KEY);
		httpSession.removeAttribute(SESSION_TOKEN_KEY);
		if(token==null){
			return false;
		}
		String reqToken = httpServletRequest.getParameter(token.getTokenName());
		if(StringUtils.isNotEmpty(reqToken)&&reqToken.equals(token.getTokenValue())){
			return true;
		}
		return false;
	}
}

3. TokenTag

package com.tag;


import java.io.IOException;

import javax.servlet.jsp.JspException;
import javax.servlet.jsp.tagext.TagSupport;

import org.apache.commons.lang.StringUtils;

import com.bean.Token;
import com.util.TokenManager;

public class TokenTag extends TagSupport {
	private static final long serialVersionUID = 4596553712387968686L;

	private String tokenName;
	
	public String getTokenName() {
		return tokenName;
	}

	public void setTokenName(String tokenName) {
		this.tokenName = tokenName;
	}

	@Override
	public int doStartTag() throws JspException {
		try {
			pageContext.getOut().write(getTagBody());
		} catch (IOException e) {
			e.printStackTrace();
			throw new JspException(e.getMessage());
		}
		return SKIP_BODY;
	}
	
	private String getTagBody() {
		String tokenValue = getToken();
		if(StringUtils.isEmpty(tokenName)){
			tokenName=Token.DEFAULT_TOKEN_NAME;
		}
		pageContext.getSession().setAttribute(TokenManager.SESSION_TOKEN_KEY,
				new Token(tokenName, tokenValue));
		String inputToken = "<input type=\"hidden\" name = \""+tokenName+"\" value=\""+tokenValue+"\" />";
		return inputToken;
	}

	private String getToken() {
		return TokenManager.generateToken();
	}

	@Override
	public int doEndTag() throws JspException {
		return EVAL_PAGE;
	}
}

4.base.tld

<?xml version="1.0" encoding="UTF-8"?>
<taglib xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/jsee/web-jsptagLibrary_2_0.xsd"
    version="2.0">
    <tlibversion>1.0</tlibversion>
    <shortname>Base Tag</shortname>

    <tag>
        <name>token</name>
        <tagclass>com.tag.TokenTag</tagclass>

        <bodycontent>empty</bodycontent>
        <attribute>
            <name>tokenName</name>
            <required>false</required>
            <rtexprvalue>true</rtexprvalue>
        </attribute>
    </tag>
</taglib>

5.在jsp页面中使用：

  <form action="test" method="post">
<%--<base:token/>
    <base:token tokenName="testToken" /> --%>
    <base:token tokenName="<%=UUID.randomUUID().toString() %>" />
    <input type="submit" value="提交" />
  </form>

6. 后台逻辑校验Token

package com.servlet;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import com.util.TokenManager;

public class TestServlet  extends HttpServlet{
	private static final long serialVersionUID = 8421484630895424911L;

	@Override
	protected void doPost(HttpServletRequest req, HttpServletResponse resp)
			throws ServletException, IOException {
		System.out.println(TokenManager.validToken(req));
	}
}

该实现支持在jsp页面中不指定tokenName，指定tokenName，随机生成tokenName；

业务逻辑无需关心token的存储方式，如需校验，只需要把req传给TokenManager即可。