oa系统禁止用户直接通过url去访问<iframe>的页面

/**
 * @author chenfeng
 * 登陆系统拦截器，验证登陆
 */

public class LoginInterceptor implements HandlerInterceptor {
    private static Logger logger = LoggerFactory.getLogger(LoginInterceptor.class);
    @Override
    public boolean preHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o) throws Exception {
        logger.info("====================拦截器启动======================");
        httpServletRequest.setAttribute("starttime",System.currentTimeMillis());

        HttpSession session=httpServletRequest.getSession();
        SystemUser systemUser= (SystemUser) session.getAttribute("loginUser");
        if (systemUser!=null){
            String s=httpServletRequest.getHeader("Referer");
            if (s==null){
                httpServletRequest.getRequestDispatcher("/login/toLogin").forward(httpServletRequest,httpServletResponse);
                return true;
            }else {
                return true;
            }

        }else {
            httpServletRequest.getRequestDispatcher("/login/toLogin").forward(httpServletRequest,httpServletResponse);
            return true;
        }
    }

    @Override
    public void postHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, ModelAndView modelAndView) throws Exception {
        logger.info("===================执行处理完毕======================");
        long starttime= (long) httpServletRequest.getAttribute("starttime");
        httpServletRequest.removeAttribute("starttime");
        long endtime=System.currentTimeMillis();
        logger.info("=========请求地址:"+httpServletRequest.getRequestURI()+":处理时间:{}",(endtime-starttime)+"ms");
    }

    @Override
    public void afterCompletion(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, Exception e) throws Exception {
        logger.info("=====================拦截器关闭=========================");
    }
}

先上代码，再来进行解释，<iframe>的页面直接通过浏览器访问header的属性Referer的值就是空，但是通过按钮点击进行内部跳转时Referer的值就是访问的路径，也就不为空了，所以可以通过这个属性是否为空来判断用户是内部跳转还是浏览器直接访问的。