跨站请求伪造

package com.wx.filter;

import com.wx.servlet.IndexServlet;
import com.wx.util.ConfKit;
import org.apache.log4j.Logger;

import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * Created by 123 on 2018-05-14
 */
@WebFilter(filterName = "RefererFilter")

public class RefererFilter implements Filter {
    public static Logger logger = Logger.getLogger(RefererFilter.class);
    public void destroy() {
    }

    public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws ServletException, IOException {
        HttpServletRequest request= (HttpServletRequest) req;
        HttpServletResponse response= (HttpServletResponse) resp;
        String referer=request.getHeader("Referer");
        logger.info("referer:"+referer);
        //如果referer是从空TAG进入的话，不能进行校验referer,其他地方的请求需要校验Referer
        if((referer==null) ||(referer.trim().startsWith(ConfKit.getProps("refererUrl")))){

            chain.doFilter(request, response);

        }else{
            req.setAttribute("msg", "异常");
            req.getRequestDispatcher("error.jsp").forward(request,response);

        }
    }

    public void init(FilterConfig config) throws ServletException {

    }

}

其中refererUrl，在测试环境下先设置为http://localhost:8080/ProjectName。