springboot跨站拦截器

对于有安全需求的系统来说，或者项目安全测试啥的一般都会对跨站请求进行验证，跨站拦截应该算是用得比较多的安全验证方式。

具体攻击细节及防护措施，请点击查看跨站请求伪造_百度百科

其中，检查Referer字段方式可以通过自定义一个跨站拦截器进行有效拦截

package cn.xxx.rdc.fi.filter;

import java.io.IOException;
import java.io.PrintWriter;
import java.util.HashMap;
import java.util.Map;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.context.annotation.Configuration;

import com.alibaba.fastjson.JSON;

import cn.trasen.BootComm.Contants;
import lombok.extern.slf4j.Slf4j;

/**
 * Referer拦截器
 * 
 * @author xxx
 * @date: 2021-04-07 16:07:09
 * @Copyright: Copyright (c) 2006 - 2021
 * @Company: xxx
 * @Version: V1.0
 */
@Slf4j
@Configuration
@ConditionalOnProperty(prefix = "referer.filter", name = "enabled", matchIfMissing = true, havingValue = "true")
public class RefererFilter implements Filter {

    @Value("${request.url.prefix}")
    private String requestUrlPrefix;

    /**
     * 验证Referer
     * 
     * @author: xxx
     * @date: 2021-04-07 16:11:08
     * @param request
     * @param response
     * @param chain
     * @throws IOException
     * @throws ServletException
     */
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {

        log.info("RefererFilter doFilter start");

        HttpServletRequest req = (HttpServletRequest)request;
        HttpServletResponse res = (HttpServletResponse)response;

        String referer = req.getHeader("Referer");

        log.info("RefererFilter doFilter refere:" + referer);

        // 验证请求地址
        if ((referer != null) && (referer.trim().startsWith(requestUrlPrefix))) {
            chain.doFilter(request, response);
        } else {
            Map<String, Object> result = new HashMap<String, Object>();
            result.put("statusCode", Contants.NO_AUTHENTICATION);
            result.put("message", "不允许跨站请求！");
            result.put("object", null);
            res.setContentType("application/json;charset=UTF-8");
            PrintWriter writer = res.getWriter();
            writer.write(JSON.toJSONString(result));
            writer.flush();
            writer.close();
            res.flushBuffer();
        }

        log.info("RefererFilter doFilter end");

    }

    @Override
    public void destroy() {
    }

    @Override
    public void init(FilterConfig arg0) throws ServletException {
        log.info("============RefererFilter 拦截器启动============");
    }

}

Contants.NO_AUTHENTICATION为自定义常量，本系统为消息码

// 未授权
public static final Integer NO_AUTHENTICATION = 21000;

配置项

# 请求地址前缀
request.url.prefix=http://192.168.18.28:7070/
# 是否开启跨站拦截：不配置或true为开启
referer.filter.enabled=false