【安全检测】Java后台项目的过滤器

【安全检测】Java后台项目的过滤器：用户是否登录、头攻击、会话重放等

 

package fhm;



import java.io.IOException;
import java.io.PrintWriter;
import java.util.Date;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.json.JSONException;
import org.json.JSONObject;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.stereotype.Component;

 
//@Order(2)
@Component
@WebFilter(filterName = "myFilter", urlPatterns = {"/*"})
public class myFilter implements Filter {
 
	private static Logger log = LoggerFactory.getLogger(myFilter.class);
	@Autowired
	private TestWhiteListUtil whiteUtils;
	 
	@Autowired
    private RedisTemplate<String, Object> redisTemplate;
	private static final Integer EXPIRE_TIME = Integer.valueOf(30);
	
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
    }
 
    @Override
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
			throws IOException, ServletException {
		HttpServletRequest httpRequest = (HttpServletRequest) request;
		HttpServletResponse httpResponse = (HttpServletResponse) response;
		httpResponse.setCharacterEncoding("UTF-8");
		httpResponse.setContentType("application/json; charset=utf-8");
		httpResponse.setHeader("Access-Control-Allow-Origin", "*");

		JSONObject jsonObject = new JSONObject();
		PrintWriter pw = null;
		String authorizeState = "error message..";

		// 1.头攻击检测:Host
		String host= httpRequest.getHeader("host");
		if (host!= null && !whiteUtils.isWhiteHost(host)) {
			httpResponse.setStatus(403);
			log.warn("头攻击 requestHost:" + host);
			authorizeState = "Head attack in progress...";
			try {
				jsonObject.put("resultHint", authorizeState);
				jsonObject.put("successful", false);
				jsonObject.put("resultValue", "");
				jsonObject.put("type", "error");
				pw = httpResponse.getWriter();
				pw.write(jsonObject.toString());

			} catch (IOException | JSONException e) {
				e.printStackTrace();
			} finally {
				pw.flush();
				pw.close();
			}
			return;
		}

		// 2.Origin跨域访问检测
		String Origin= httpRequest.getHeader("Origin");
		//...省略 

		// 3.对数据请求中的referer值进行验证，防止CSRF风险
		String Referer= httpRequest.getHeader("Referer");
		//...省略

		// 4.时间戳判断
		String url = httpRequest.getRequestURI().substring(httpRequest.getContextPath().length());
		if ((url.startsWith("/")) && (url.length() > 1)) {
			url = url.substring(1).split("/")[0];
		}
		String cl_token_id = httpRequest.getParameter("QW");
		//...省略
  

		// 5. 判断用户是否登录及失效
		String iscUserId = httpRequest.getParameter("userId");
		if ((iscUserId == null) || ("".equals(iscUserId) || ("undefined".equals(iscUserId)))) {
			System.out.println("没有登录，请联系管理员");
			httpResponse.setStatus(403);
			authorizeState = "userId is null";
			try {
				jsonObject.put("resultHint", authorizeState);
				jsonObject.put("successful", false);
				jsonObject.put("resultValue", "");
				jsonObject.put("type", "error");
				pw = httpResponse.getWriter();
				pw.write(jsonObject.toString());
			} catch (IOException | JSONException e) {
				e.printStackTrace();
			} finally {
				pw.flush();
				pw.close();
			}
			return;
		}
		
		Boolean hasKey = this.redisTemplate.hasKey(iscUserId);
		if (!hasKey.booleanValue()) {
			System.out.println("用户信息失效");
			httpResponse.setStatus(403);
			authorizeState = "userInfo is null";
			try {
				jsonObject.put("resultHint", authorizeState);
				jsonObject.put("successful", false);
				jsonObject.put("resultValue", "");
				jsonObject.put("type", "error");
				pw = httpResponse.getWriter();
				pw.write(jsonObject.toString());
			} catch (IOException | JSONException e) {
				e.printStackTrace();
			} finally {
				pw.flush();
				pw.close();
			}
			return;
		}
		this.redisTemplate.expire(iscUserId, EXPIRE_TIME.intValue(), TimeUnit.MINUTES); 

		chain.doFilter(httpRequest, httpResponse);
	}
 
    @Override
    public void destroy() {
 
    }
 
   
 
}

 

 

package fhm;

import java.util.List;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;

/**
 * 服务器白名单列表
 */
@Component
public class TestWhiteListUtil {
	
	@Value("${Host.whiteList}")
    private String hostWhiteList;
	
	private static Logger log = LoggerFactory.getLogger(TestWhiteListUtil.class);

	/**
	 * 判断当前host是否在白名单内
	 * @param host 待查host
	 */
	public boolean isWhiteHost(String host) {
		String[] whiteList = hostWhiteList.split(",");
		if (whiteList == null || whiteList.length == 0) {
			return true;
		}
		for (Object str : whiteList) {
			if (str != null && str.equals(host)) {
				return true;
			}
		}
		return false;
	}
	
	/**
	 * Origin跨域访问
	 * @param Origin
	 * @return
	 */
	public boolean isWhiteOrigin(String Origin) {
		//...省略
		return false;
	}
	/**
	 * 对数据请求中的referer值进行验证，防止CSRF风险
	 * @param Referer
	 * @return
	 */
	public boolean isWhiteReferer(String Referer) {
		//...省略
		return false;
	}
	
	
}