修改Request与Response中的内容

需求背景：与客户端通信内容需要加密。客户端将请求参数进行加密，服务端对响应结果进行加密。

那么对于后端而言，最方便的就是在过滤器里面对请求、响应进行统一处理了。这里需要涉及到HttpServletRequestWrapper与HttpServletResponseWrapper。

【1】非json请求处理

如下所示ParameterRequestWrapper 继承自HttpServletRequestWrapper ，重写获取参数的方法。

/**
 * Created by jianggc at 2022/4/5.
 */
public class ParameterRequestWrapper extends HttpServletRequestWrapper {
    private Map<String , String[]> params = new HashMap<String, String[]>();

    @SuppressWarnings("unchecked")
    public ParameterRequestWrapper(HttpServletRequest request) {
        // 将request交给父类，以便于调用对应方法的时候，将其输出
        super(request);
        //将参数表，赋予给当前的Map以便于持有request中的参数
        this.params.putAll(request.getParameterMap());
    }
    //重载一个构造方法
    public ParameterRequestWrapper(HttpServletRequest request , Map<String , Object> extendParams) {
        this(request);
        addAllParameters(extendParams);//这里将扩展参数写入参数表
    }

    @Override
    public String getParameter(String name) {//重写getParameter，代表参数从当前类中的map获取
        String[]values = params.get(name);
        if(values == null || values.length == 0) {
            return null;
        }
        return values[0];
    }

    @Override
    public Enumeration<String> getParameterNames() {
        return new Vector(params.keySet()).elements();
    }

    @Override
    public String[] getParameterValues(String name) {
        String[] values = params.get(name);
        if (values == null || values.length == 0) {
            return null;
        }
        return values;
    }


    public void addAllParameters(Map<String , Object>otherParams) {//增加多个参数
        for(Map.Entry<String , Object>entry : otherParams.entrySet()) {
            addParameter(entry.getKey() , entry.getValue());
        }
    }

    public void addParameter(String name , Object value) {//增加参数
        if(value != null) {
            if(value instanceof String[]) {
                params.put(name , (String[])value);
            }else if(value instanceof String) {
                params.put(name , new String[] {(String)value});
            }else {
                params.put(name , new String[] {String.valueOf(value)});
            }
        }
    }
}

上面给了入口方法addAllParameters让你可以放入需要的数据。这个操作是在过滤器里面处理的。

由于与客户端协商了参数传递方式为params=encrypt(userName=jane&mobile=13813813800),所以这里我们对params进行处理，回复为springboot喜欢的格式。

/**
 * Created by jianggc at 2022/4/5.
 */
@WebFilter(urlPatterns={"/*"})
public class RequestAesFilter implements Filter {
    private static final Logger logger= LoggerFactory.getLogger(RequestAesFilter.class);
    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        // 获取request
        HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest;
        String params = httpServletRequest.getParameter("params");
        Map<String,Object> parmMap= new HashMap<>();
        if(!StringUtils.isEmpty(params)){
            try {
                String decryptBase64 = AesUtils.decryptBase64(params, AesUtils.aesKey);
                String[] split = decryptBase64.split("&");
                for(String entry:split){
                    String[] strings = entry.split("=");
                    parmMap.put(strings[0],strings[1]);
                }
            } catch (Exception e) {
                logger.error(e.getMessage(),e);
            }
        }
        logger.debug("解密后的parmMap：{}",parmMap);
        ParameterRequestWrapper pr = new ParameterRequestWrapper(httpServletRequest, parmMap);
        chain.doFilter(pr, response);

    }
}

【2】响应处理

这里ResponseWrapper继承自HttpServletResponseWrapper提供了写入和读取的方法。

public class ResponseWrapper extends HttpServletResponseWrapper {

    // 真正缓存数据的流
    private ByteArrayOutputStream byteArrayOutputStream = null;
    private ServletOutputStream servletOutputStream = null;
    private PrintWriter writer = null;

    public ResponseWrapper(HttpServletResponse response) {
        super(response);
        // TODO Auto-generated constructor stub
        byteArrayOutputStream = new ByteArrayOutputStream();
        servletOutputStream = new WrapperOutputStream(byteArrayOutputStream);
        writer = new PrintWriter(byteArrayOutputStream);
    }

    /**
     *     当获取字节输出流时，实际获取的是我们自己包装的字节输出流
     */
    public ServletOutputStream getOutputStream() {
        return servletOutputStream;
    }

    /**
     *     当获取字符输出流时，实际获取的是我们自己包装的字符输出流
     */
    public PrintWriter getWriter() {
        return writer;
    }

    public void flushBuffer() throws IOException {
        if (servletOutputStream != null) {
            servletOutputStream.flush();
        }
        if (writer != null) {
            writer.flush();
        }
    }

    public Map<String, String> getHeaders() {
        Map<String, String> headers = new HashMap(0);
        Iterator var3 = this.getHeaderNames().iterator();

        while(var3.hasNext()) {
            String headerName = (String)var3.next();
            headers.put(headerName, this.getHeader(headerName));
        }

        return headers;
    }


    public byte[] getResponseData() throws IOException {
        flushBuffer();
        return byteArrayOutputStream.toByteArray();
    }

    public String getContent() throws IOException {
        flushBuffer();
        return byteArrayOutputStream.toString();
    }
}

class WrapperOutputStream extends ServletOutputStream {

    private ByteArrayOutputStream baos;

    public WrapperOutputStream(ByteArrayOutputStream out) {
        super();
        this.baos = out;
    }

    public boolean isReady() {
        return true;
    }

    public void write(int b) throws IOException {
        this.baos.write(b);
    }

    public void write(byte[] b) throws IOException {
        this.baos.write(b);
    }

    public void write(byte[] b, int off, int len) throws IOException {
        this.baos.write(b, off, len);
    }

    public String getContent() {
        return this.baos.toString();
    }

    public byte[] toByteArray() {
        return this.baos.toByteArray();
    }


    @Override
    public void setWriteListener(WriteListener listener) {

    }
}

同样的思路，我们在过滤器里面对响应结果进行加密。

/**
 * Created by jianggc at 2022/4/5.
 */
@WebFilter(urlPatterns={"/*"})
public class ResponseAesFilter implements Filter {
    private static final Logger logger= LoggerFactory.getLogger(ResponseAesFilter.class);
    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        ResponseWrapper responseWrapper = new ResponseWrapper((HttpServletResponse) response);
        HttpServletRequest httpServletRequest= (HttpServletRequest) servletRequest;
        String requestURI = httpServletRequest.getRequestURI();
        chain.doFilter(servletRequest, responseWrapper);
        String wrapperContent = responseWrapper.getContent();
        logger.debug("当前请求requestURI：{}",requestURI);
        logger.debug("当前请求获取的响应数据：{}",wrapperContent);
        if(requestURI.startsWith("/app")){// 只对安卓端进行处理
            try{
                JSONObject parseObject = JSONObject.parseObject(wrapperContent);
                JSONObject dataObj = parseObject.getJSONObject("data");
                if(dataObj!=null&&!dataObj.isEmpty()){
                    String dataObjStr=JsonUtil.replaceAllBlank(dataObj.toJSONString());
                    String encryptBase64 = AesUtils.encryptBase64(dataObjStr, AesUtils.aesKey);
                    logger.debug("加密后的响应data：{}",encryptBase64);
                    parseObject.put("data",JsonUtil.replaceAllBlank(encryptBase64));
                    String decryptBase64 = AesUtils.decryptBase64(encryptBase64, AesUtils.aesKey);
                    logger.debug("解密后的响应data：{}",decryptBase64);
                }
                wrapperContent=parseObject.toJSONString();
                logger.debug("当前安卓请求加密的响应数据：{}",wrapperContent);
            }catch (Exception e){
                logger.error(e.getMessage(),e);
            }
        }
        ServletOutputStream out = response.getOutputStream();
        out.write(wrapperContent.getBytes(Charset.forName("UTF-8")));
        out.flush();
    }
}

【3】JSON流替换request

【1】中有一个弊端就是不能处理json，request.getParameterMap()只能处理form-data(queryString)数据，没有办法处理application/json的数据。所以我们采用如下格式来兼容：

public class BodyReaderHttpServletRequestWrapper extends HttpServletRequestWrapper{

    private static final Logger logger= LoggerFactory.getLogger(BodyReaderHttpServletRequestWrapper.class);


    private final byte[] body;
    public BodyReaderHttpServletRequestWrapper(HttpServletRequest request) throws IOException {
        super(request);
        body = getBodyString(request).getBytes(Charset.forName("UTF-8"));
    }
    private static String getBodyString(ServletRequest request) {
        StringBuilder sb = new StringBuilder();
        InputStream inputStream = null;
        BufferedReader reader = null;
        try {
            inputStream = request.getInputStream();
            reader = new BufferedReader(new InputStreamReader(inputStream, Charset.forName("UTF-8")));
            String line = "";
            while ((line = reader.readLine()) != null) {
                sb.append(line);
            }
        } catch (IOException e) {
            logger.error(e.getMessage(),e);
        } finally {
            if (inputStream != null) {
                try {
                    inputStream.close();
                } catch (IOException e) {
                    logger.error(e.getMessage(),e);
                }
            }
            if (reader != null) {
                try {
                    reader.close();
                } catch (IOException e) {
                    logger.error(e.getMessage(),e);
                }
            }
        }
        return sb.toString();
    }

    @Override
    public BufferedReader getReader() throws IOException {
        return new BufferedReader(new InputStreamReader(getInputStream()));
    }

    @Override
    public ServletInputStream getInputStream() throws IOException {
        final ByteArrayInputStream bais = new ByteArrayInputStream(body);
        return new ServletInputStream() {
			@Override
			public int read() throws IOException {
				return bais.read();
			}

           
            public boolean isFinished() {
                return false;
            }

           
            public boolean isReady() {
                return false;
            }


			public void setReadListener(ReadListener arg0) {
				// TODO Auto-generated method stub
				
			}
        };
    }

}

可以看到这里我们缓存body字节流来实现request重复读取流。需要特别注意的是，当你替换request的时候，不要对上传文件请求进行处理否则就会抛出类似下面异常。

Caused by: org.springframework.web.multipart.MultipartException: Failed to parse multipart servlet request; nested exception is java.io.IOException: org.apache.tomcat.util.http.fileupload.FileUploadException: Stream closed
	at org.springframework.web.multipart.support.StandardMultipartHttpServletRequest.handleParseFailure(StandardMultipartHttpServletRequest.java:124)
	at org.springframework.web.multipart.support.StandardMultipartHttpServletRequest.parseRequest(StandardMultipartHttpServletRequest.java:115)
	at org.springframework.web.multipart.support.StandardMultipartHttpServletRequest.<init>(StandardMultipartHttpServletRequest.java:88)
	at org.springframework.web.multipart.support.StandardServletMultipartResolver.resolveMultipart(StandardServletMultipartResolver.java:87)
	at org.springframework.web.servlet.DispatcherServlet.checkMultipart(DispatcherServlet.java:1178)
	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1012)
	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:943)
	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006)
	... 48 common frames omitted
Caused by: java.io.IOException: org.apache.tomcat.util.http.fileupload.FileUploadException: Stream closed
	at org.apache.catalina.connector.Request.parseParts(Request.java:2916)
	at org.apache.catalina.connector.Request.getParts(Request.java:2771)
	at org.apache.catalina.connector.RequestFacade.getParts(RequestFacade.java:1098)
	at javax.servlet.http.HttpServletRequestWrapper.getParts(HttpServletRequestWrapper.java:359)
	at javax.servlet.http.HttpServletRequestWrapper.getParts(HttpServletRequestWrapper.java:359)
	at org.springframework.web.multipart.support.StandardMultipartHttpServletRequest.parseRequest(StandardMultipartHttpServletRequest.java:95)
	... 54 common frames omitted
Caused by: org.apache.tomcat.util.http.fileupload.FileUploadException: Stream closed
	at org.apache.tomcat.util.http.fileupload.FileUploadBase.parseRequest(FileUploadBase.java:306)
	at org.apache.catalina.connector.Request.parseParts(Request.java:2869)
	... 59 common frames omitted
Caused by: java.io.IOException: Stream closed
	at org.apache.catalina.connector.InputBuffer.read(InputBuffer.java:359)
	at org.apache.catalina.connector.CoyoteInputStream.read(CoyoteInputStream.java:132)
	at java.io.FilterInputStream.read(FilterInputStream.java:133)
	at org.apache.tomcat.util.http.fileupload.util.LimitedInputStream.read(LimitedInputStream.java:132)
	at org.apache.tomcat.util.http.fileupload.MultipartStream$ItemInputStream.makeAvailable(MultipartStream.java:977)
	at org.apache.tomcat.util.http.fileupload.MultipartStream$ItemInputStream.read(MultipartStream.java:881)
	at java.io.InputStream.read(InputStream.java:101)
	at org.apache.tomcat.util.http.fileupload.util.Streams.copy(Streams.java:98)
	at org.apache.tomcat.util.http.fileupload.util.Streams.copy(Streams.java:68)
	at org.apache.tomcat.util.http.fileupload.MultipartStream.readBodyData(MultipartStream.java:572)
	at org.apache.tomcat.util.http.fileupload.MultipartStream.discardBodyData(MultipartStream.java:596)
	at org.apache.tomcat.util.http.fileupload.MultipartStream.skipPreamble(MultipartStream.java:614)
	at org.apache.tomcat.util.http.fileupload.impl.FileItemIteratorImpl.findNextItem(FileItemIteratorImpl.java:213)
	at org.apache.tomcat.util.http.fileupload.impl.FileItemIteratorImpl.<init>(FileItemIteratorImpl.java:127)
	at org.apache.tomcat.util.http.fileupload.FileUploadBase.getItemIterator(FileUploadBase.java:256)
	at org.apache.tomcat.util.http.fileupload.FileUploadBase.parseRequest(FileUploadBase.java:280)
	... 60 common frames omitted