对于有安全需求的系统来说,或者项目安全测试啥的一般都会对跨站请求进行验证,跨站拦截应该算是用得比较多的安全验证方式。
具体攻击细节及防护措施,请点击查看跨站请求伪造_百度百科
其中,检查Referer字段方式可以通过自定义一个跨站拦截器进行有效拦截
package cn.xxx.rdc.fi.filter;
import java.io.IOException;
import java.io.PrintWriter;
import java.util.HashMap;
import java.util.Map;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.context.annotation.Configuration;
import com.alibaba.fastjson.JSON;
import cn.trasen.BootComm.Contants;
import lombok.extern.slf4j.Slf4j;
/**
* Referer拦截器
*
* @author xxx
* @date: 2021-04-07 16:07:09
* @Copyright: Copyright (c) 2006 - 2021
* @Company: xxx
* @Version: V1.0
*/
@Slf4j
@Configuration
@ConditionalOnProperty(prefix = "referer.filter", name = "enabled", matchIfMissing = true, havingValue = "true")
public class RefererFilter implements Filter {
@Value("${request.url.prefix}")
private String requestUrlPrefix;
/**
* 验证Referer
*
* @author: xxx
* @date: 2021-04-07 16:11:08
* @param request
* @param response
* @param chain
* @throws IOException
* @throws ServletException
*/
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
log.info("RefererFilter doFilter start");
HttpServletRequest req = (HttpServletRequest)request;
HttpServletResponse res = (HttpServletResponse)response;
String referer = req.getHeader("Referer");
log.info("RefererFilter doFilter refere:" + referer);
// 验证请求地址
if ((referer != null) && (referer.trim().startsWith(requestUrlPrefix))) {
chain.doFilter(request, response);
} else {
Map<String, Object> result = new HashMap<String, Object>();
result.put("statusCode", Contants.NO_AUTHENTICATION);
result.put("message", "不允许跨站请求!");
result.put("object", null);
res.setContentType("application/json;charset=UTF-8");
PrintWriter writer = res.getWriter();
writer.write(JSON.toJSONString(result));
writer.flush();
writer.close();
res.flushBuffer();
}
log.info("RefererFilter doFilter end");
}
@Override
public void destroy() {
}
@Override
public void init(FilterConfig arg0) throws ServletException {
log.info("============RefererFilter 拦截器启动============");
}
}
Contants.NO_AUTHENTICATION为自定义常量,本系统为消息码
// 未授权
public static final Integer NO_AUTHENTICATION = 21000;
配置项
# 请求地址前缀
request.url.prefix=http://192.168.18.28:7070/
# 是否开启跨站拦截:不配置或true为开启
referer.filter.enabled=false