12 Http

最新推荐文章于 2023-08-07 14:19:38 发布

流星天道酬勤

最新推荐文章于 2023-08-07 14:19:38 发布

阅读量322

点赞数

本文链接：https://blog.csdn.net/weixin_41673498/article/details/104371114

版权

技术烩菜专栏收录该内容

38 篇文章 0 订阅

订阅专栏

4Http反盗链技术判断请求头referer

跨域解决方式一：http请求头设置允许跨域

跨域解决方式二：jsoup只支持get请求核心底层采用脚本注入

解决方式三：httpclient内部转发

方式四：nginx搭建企业级接口网关

方式五：使用spring zull接口网关

防止模拟请求 token（redis存储）

Http协议

Http协议--微服务架构 rpc+http

反盗链：网站不能别其他网站引用

重定向比转发慢，重定向两次；

ajax默认异步

请求头

时间戳防止浏览器缓存

打包加上时间戳防止浏览器缓存

2Http请求头

3时间戳解决浏览器缓存

304表示从本地读取，200是服务器读取

每次发布版本在图片，js，加上时间戳防止缓存有冲突

刷新后缓存到本地

4Http反盗链技术判断请求头referer

实现

本地host配置

a,b项目加上

b访问a ,b.jsp

java实现

  <!-- https://mvnrepository.com/artifact/javax.servlet/servlet-api -->
       <dependency>
           <groupId>javax.servlet</groupId>
           <artifactId>servlet-api</artifactId>
           <version>3.0-alpha-1</version>
           <scope>provided</scope>
       </dependency>

web.xml

<filter>
        <filter-name>imgFilter</filter-name>
        <filter-class>com.web.ImgFilter</filter-class>

    </filter>
   <filter-mapping>
    <filter-name>imgFilter</filter-name>
       <url-pattern>/imgs/*</url-pattern>
</filter-mapping>

java代码

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class ImgFilter implements Filter {
    public void init(FilterConfig filterConfig) throws ServletException {

        System.out.println("初始化过滤器。。。");
    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        System.out.println("doFilter...........");
        HttpServletRequest req= (HttpServletRequest) request;
        HttpServletResponse res= (HttpServletResponse) response;
        String referer = req.getHeader("referer");
        //请求服务器名称 http://a.a.com
        String serverName = req.getServerName();
        if (null==referer||!(referer.contains(serverName))){
            req.getRequestDispatcher("/img/error.png").forward(req,res);
            return;
        }
        //放行
        chain.doFilter(req,res);

    }

    public void destroy() {

    }
}

5转发和重定向实现原理

Http80 与Https 4443区别

保证安全

https证书 4443端口，加密传输，token

http默认80端口

httpClient发送http请求

<!-- https://mvnrepository.com/artifact/org.apache.httpcomponents/httpcore -->
       <dependency>
           <groupId>org.apache.httpcomponents</groupId>
           <artifactId>httpcore</artifactId>
           <version>4.4.10</version>
       </dependency>

       <!-- https://mvnrepository.com/artifact/org.apache.httpcomponents/httpclient -->
       <dependency>
           <groupId>org.apache.httpcomponents</groupId>
           <artifactId>httpclient</artifactId>
           <version>4.5.6</version>
       </dependency>

import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.util.EntityUtils;

public class HttpClientDemo {
    public static void main(String[] args) {
        get();
    }
     //爬虫 跨域
    public static   void  get(){
        try {
            //创建默认连接
            CloseableHttpClient httpClient = HttpClients.createDefault();
            //创建get请求
            HttpGet httpGet = new HttpGet("");
            CloseableHttpResponse response = httpClient.execute(httpGet);
            //获取状态
            int code = response.getStatusLine().getStatusCode();
            System.out.println("http请求code:::"+code);
            if (code==200){
                System.out.println(EntityUtils.toString(response.getEntity()));
            }
            response.close();
            httpClient.close();
        }catch (Exception e){

        }

    }
}

post请求

Http的长连接和短连接

http1.0短连接

http1.1保留短连接，新增长连接，默认 keep-alive为长连接

底层是tcp协议--三次握手

长链接关闭做四次挥手

移动app用长链接关闭浏览器，不关闭链接

跨域实战解决方案（重）只在ajax产生

跨域问题是浏览器的一种机制

跨域解决方式一：http请求头设置允许跨域

a项目中加入，允许b站访问

跨域解决方式二：jsoup只支持get请求

底层做回调

服务器端：

客户端：

如果ajax设置post,后台doGet调用doPost也ok，原理其实是转get请求

参考 https://www.cnblogs.com/wqhwe/p/5816941.html

解决方式三：httpclient内部转发

不存在跨域，浪费资源，优点：安全，抓包分析不到

b项目

a项目

方式四：nginx搭建企业级接口网关

方式五：使用spring zull接口网关

防止模拟请求 token（redis存储）

表单重复提交：网络延迟，刷新，重新加载，回退--解决方式 token 唯一性

解决方式--前端加标识（不能解决），因为重新加载还会重复提交，如下图

token 令牌类似于sessionId,存入session,传入页面

服务端

  @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
       String token= UUID.randomUUID().toString();
       req.getSession().setAttribute("sessiontoken",token);
       req.getRequestDispatcher("from.jsp").forward(req,resp);
    }

客户端

from.jsp

  <input type="hidden" value="${sessiontoken}" name="sessiontoken"/>

 @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        if(!isFlag(req)){
            resp.getWriter().write("fail");
            System.out.println("不要重复提交");
            return;
        }
    }

    public boolean isFlag(HttpServletRequest request){
       String token = request.getParameter("sessiontoken");
       if (null==token){
           System.out.println("token为空，不能重复提交");
           return false;
       }
       String sessiontoken =(String) request.getSession().getAttribute("sessiontoken");
       if (sessiontoken==null){
           System.out.println("不要重复提交");
           return false;
       }
       if (!sessiontoken.equals(token)){
           System.out.println("不要伪造token");
           return false;
       }
       //删除token
       request.getSession().removeAttribute("sessiontoken");
       return true;
   }

防止模拟请求 (token+验证码)

XSS攻击（web前端，脚本注入）

在提交按钮输入脚本，提交script脚本

<script>alert("122")</script>
<script>localtion.href="钓鱼网站"</script>

使用转义解决XSS攻击

使用谷歌或者360，解决了xss，火狐不行添加的时候都过滤

       <dependency>
           <groupId>org.apache.commons</groupId>
           <artifactId>commons-lang3</artifactId>
           <version>3.0</version>
       </dependency>

web.xml


    <filter>
        <filter-name>FilterXSS</filter-name>
        <filter-class>com.xss.FilterXSS</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>FilterXSS</filter-name>
        <!---根据情况 动静分离-->
        <url-pattern>/*</url-pattern>
    </filter-mapping>

转换器

XSSHttpServerRequest.java

package com.xss;
import org.apache.commons.lang3.StringEscapeUtils;
import org.apache.commons.lang3.StringUtils;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

public class XSSHttpServerRequest extends HttpServletRequestWrapper {
  private HttpServletRequest request;
    public XSSHttpServerRequest(HttpServletRequest request) {

        super(request);
        this.request=request;
    }

    @Override
    public String getParameter(String name) {
        String value = request.getParameter(name);
        System.out.println("没有转换：value"+value);
        if (!(StringUtils.isEmpty(value))){
            //转换html
            value = StringEscapeUtils.escapeHtml4(value);
            System.out.println("转换后：value"+value);
        }
        return value;
    }
}

过滤器

FilterXSS.java

package com.xss;
import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;
public class FilterXSS implements Filter {
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        System.out.println("dofilter...");
        HttpServletRequest req=(HttpServletRequest) request;
        XSSHttpServerRequest xssHttpServerRequest = new XSSHttpServerRequest(req);
        //放行
        chain.doFilter(xssHttpServerRequest,response);
    }

    @Override
    public void destroy() {

    }
}