HttpServletRequestWrapper的使用：二次封装/处理Request

ResponseWrapper同理

背景

有段程序使用Http的方式与业务方交互，而且是明文传输数据。我方的代码已经打包放在服务器上运行了很长时间，这时突然要求修改数据传输的方式，要求加密后再传输，而我方的原有的代码不能改变，以防止引发其它问题。

如何在不修改我方现有的代码的前提下，满足合作商的要求？

技术方案

采用Filter+HttpServletRequestWrapper就可以解决这个问题。
首先：在filter中拦截到加密后的请求，将参数解密，然后组装成一个新的明文请求串。
然后：重写HttpServletRequestWrapper中的getInputStream()方法，让其返回过滤器解析后的明文串即可。

写两个一摸一样的servlet，一个用来直接接收合作商的明文请求并打印；一个用来接收Filter处理后的合作商的请求并打印（Filter中将合作商加密后的参数解密再传给这个Servlet）。

@WebServlet("/SiServlet")  
public class SiServlet extends HttpServlet {  
    private static final long serialVersionUID = 1L;  
  
    /** 
     * @see HttpServlet#HttpServlet() 
     */  
    public SiServlet() {  
        super();  
    }  
  
    /** 
     * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse 
     *      response) 
     */  
    protected void doGet(HttpServletRequest request,  
            HttpServletResponse response) throws ServletException, IOException {  
        this.doPost(request, response);  
    }  
  
    /** 
     * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse 
     *      response) 
     *  
     */  
    protected void doPost(HttpServletRequest request,  
            HttpServletResponse response) throws ServletException, IOException {  
        String bizBindMsg = IOUtils.toString(request.getInputStream(), "UTF-8");  
        bizBindMsg = URLDecoder.decode(bizBindMsg.toString(), "UTF-8");  
        System.out.println("SiServlet接收到请求为: " + bizBindMsg);  
  
        response.getWriter().write("==========success=========");  
    }  
}  
@WebServlet("/SiServletNormal")  
public class SiServletNormal extends HttpServlet {  
    private static final long serialVersionUID = 1L;  
  
    /** 
     * @see HttpServlet#HttpServlet() 
     */  
    public SiServletNormal() {  
        super();  
    }  
  
    /** 
     * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse 
     *      response) 
     */  
    protected void doGet(HttpServletRequest request,  
            HttpServletResponse response) throws ServletException, IOException {  
        this.doPost(request, response);  
    }  
  
    /** 
     * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse 
     *      response) 
     *  
     */  
    protected void doPost(HttpServletRequest request,  
            HttpServletResponse response) throws ServletException, IOException {  
        String bizBindMsg = IOUtils.toString(request.getInputStream(), "UTF-8");  
        bizBindMsg = URLDecoder.decode(bizBindMsg.toString(), "UTF-8");  
        System.out.println("SiServletNormal接收到请求为: " + bizBindMsg);  
  
        response.getWriter()  
                .write("==========SiServletNormal Success=========");  
    }  
}  

然后我使用HttpClient模拟了一下合作商发送明文和密文请求的过程，加密使用Base64简单模拟一下。

public class AdcClient {  
    private HttpPost httpPost = null;  
    private HttpClient client = null;  
    private List<NameValuePair> pairs = null;  
  
    public AdcClient() {  
        httpPost = new HttpPost("http://localhost:8080/filtertest/SiServlet");  
        client = new DefaultHttpClient();  
    }  
  
    /** 
     * 发送明文消息 
     *  
     */  
    public void sendMsg() {  
  
        try {  
            httpPost = new HttpPost(  
                    "http://localhost:8080/filtertest/SiServletNormal");  
  
            pairs = new ArrayList<NameValuePair>();  
            pairs.add(new BasicNameValuePair(("param1"), "obama没加密"));  
            pairs.add(new BasicNameValuePair(("param2"), "男没加密"));  
            pairs.add(new BasicNameValuePair(("param3"), "汉没加密"));  
            pairs.add(new BasicNameValuePair(("param4"), "山东没加密"));  
  
            httpPost.setEntity(new UrlEncodedFormEntity(pairs, "UTF-8"));  
            // httpPost.setHeader("Cookie", "TOKEN=1234567890");  
            HttpResponse response = client.execute(httpPost);  
  
            HttpEntity entity = response.getEntity();  
            BufferedReader br = new BufferedReader(new InputStreamReader(  
                    entity.getContent()));  
            String line = null;  
            StringBuffer result = new StringBuffer();  
            while ((line = br.readLine()) != null) {  
                result.append(line);  
                line = br.readLine();  
            }  
  
            System.out.println("来自SiServletNormal的响应为:" + result.toString());  
        } catch (UnsupportedEncodingException e) {  
            e.printStackTrace();  
        } catch (ClientProtocolException e) {  
            e.printStackTrace();  
        } catch (IOException e) {  
            e.printStackTrace();  
        }  
    }  
  
    /** 
     * 发送加密后的消息 
     */  
    public void sendEncryptMsg() {  
        try {  
            pairs = new ArrayList<NameValuePair>();  
            pairs.add(new BasicNameValuePair(("param1"), Base64EnDecrypt  
                    .base64Encode("obama")));  
            pairs.add(new BasicNameValuePair(("param2"), Base64EnDecrypt  
                    .base64Encode("男")));  
            pairs.add(new BasicNameValuePair(("param3"), Base64EnDecrypt  
                    .base64Encode("汉")));  
            pairs.add(new BasicNameValuePair(("param4"), Base64EnDecrypt  
                    .base64Encode("山东")));  
  
            HttpEntity reqEntity = new UrlEncodedFormEntity(pairs, "UTF-8");  
            httpPost.setEntity(reqEntity);  
            // httpPost.setHeader("Cookie", "TOKEN=1234567890");  
            HttpResponse response = client.execute(httpPost);  
  
            /** 
             * 获取响应信息 
             */  
            HttpEntity entity = response.getEntity();  
            BufferedReader br = new BufferedReader(new InputStreamReader(  
                    entity.getContent()));  
            String line = null;  
            StringBuffer result = new StringBuffer();  
            while ((line = br.readLine()) != null) {  
                result.append(line);  
                line = br.readLine();  
            }  
  
            System.out.println("来自SiServlet的响应为:" + result.toString());  
        } catch (UnsupportedEncodingException e) {  
            e.printStackTrace();  
        } catch (ClientProtocolException e) {  
            e.printStackTrace();  
        } catch (IOException e) {  
            e.printStackTrace();  
        }  
    }  
  
    /** 
     * @param args 
     * @throws UnsupportedEncodingException 
     */  
    public static void main(String[] args) throws UnsupportedEncodingException {  
        new AdcClient().sendMsg();  
  
        new AdcClient().sendEncryptMsg();  
    }  
}  

重点是下面的这个HttpServletRequestWrapper，我重写了它的getInputStream()方法，这个方法返回包含明文的ServletInputStream

public class MyRequestWrapper extends HttpServletRequestWrapper {  
    private HttpServletRequest request;  
  
    public MyRequestWrapper(HttpServletRequest request) {  
        super(request);  
        this.request = request;  
    }  
  
    /** 
     * 先解密，获取明文；然后将明文转化为字节数组；然后再去读取字节数组中的内容 
     */  
    @Override  
    public ServletInputStream getInputStream() {  
        String bizBindMsg = null;  
        ServletInputStream stream = null;  
  
        try {  
            stream = request.getInputStream();  
            bizBindMsg = IOUtils.toString(stream, "UTF-8");  
        } catch (IOException e) {  
            e.printStackTrace();  
        }  
        try {  
            bizBindMsg = URLDecoder.decode(bizBindMsg.toString(), "UTF-8");  
        } catch (UnsupportedEncodingException e) {  
            e.printStackTrace();  
        }  
        System.out.println("MyRequestWrapper接收到的请求为: " + bizBindMsg);  
  
        /** 
         * 获取加密的值进行解密 
         */  
        final StringBuffer reqStr = new StringBuffer();  
        reqStr.append("param1=").append(  
                Base64EnDecrypt.base64Decode(bizBindMsg.substring(  
                        bizBindMsg.indexOf("param1=") + 7,  
                        bizBindMsg.indexOf("param2="))));  
        reqStr.append("&");  
        reqStr.append("param2=").append(  
                Base64EnDecrypt.base64Decode(bizBindMsg.substring(  
                        bizBindMsg.indexOf("param2=") + 7,  
                        bizBindMsg.indexOf("param3="))));  
        reqStr.append("&");  
        reqStr.append("param3=").append(  
                Base64EnDecrypt.base64Decode(bizBindMsg.substring(  
                        bizBindMsg.indexOf("param3=") + 7,  
                        bizBindMsg.indexOf("param4="))));  
        reqStr.append("&");  
        reqStr.append("param4=").append(  
                Base64EnDecrypt.base64Decode(bizBindMsg.substring(bizBindMsg  
                        .indexOf("param4=") + 7)));  
  
        System.out.println("********MyRequestWrapper接收到的解密后的请求为*********");  
        System.out.println(reqStr.toString());  
  
        /** 
         * 将解密后的明文串放到buffer数组中 
         */  
        byte[] buffer = null;  
        try {  
            buffer = reqStr.toString().getBytes("UTF-8");  
        } catch (UnsupportedEncodingException e) {  
            e.printStackTrace();  
        }  
        final ByteArrayInputStream bais = new ByteArrayInputStream(buffer);  
  
        ServletInputStream newStream = new ServletInputStream() {  
  
            @Override  
            public int read() throws IOException {  
                return bais.read();  
            }  
        };  
        return newStream;  
    }  
}  

最后是简单的Filter，在这里将加密后的ServletRequest重新包装，交给SiServlet进行处理

public class EncryptFilter implements Filter {  
  
    @Override  
    public void destroy() {  
    }  
  
    @Override  
    public void doFilter(ServletRequest request, ServletResponse response,  
            FilterChain chain) throws IOException, ServletException {  
  
        chain.doFilter(new MyRequestWrapper((HttpServletRequest) request),  
                response);  
    }  
  
    @Override  
    public void init(FilterConfig arg0) throws ServletException {  
  
    }  
  
}  

我的web.xml中是这样配置的

<filter>  
    <filter-name>encryptFilter</filter-name>  
    <filter-class>com.test.filter.EncryptFilter</filter-class>  
  </filter>  
  <filter-mapping>  
    <filter-name>encryptFilter</filter-name>  
    <url-pattern>/SiServlet</url-pattern>  
  </filter-mapping>  

确保过滤器entyptFilter只拦截到SiServlet的请求即可。

运行AdcClient，可以看到下面的结果

这里的重点是MyRequestWrapper中重写的getInputStream()方法。大家可以看看API中关于HttpServletRequest的用法http://tomcat.apache.org/tomcat-5.5-doc/servletapi/index.html。