|
@@ -31,17 +31,17 @@ import com.iamberry.wechat.tools.IpAddressUtil;
|
|
|
*/
|
|
|
//@WebFilter(value = {"/admin/*", "/loginUI"})
|
|
|
public class CSRFTokenFilter implements Filter {
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
* DES对称加密
|
|
|
*/
|
|
|
private static MD5 md5 = new MD5();
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
* 后台登录地址
|
|
|
*/
|
|
|
private static String ADMIN_LOGIN_URL;
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
* 签名格式
|
|
|
*/
|
|
@@ -52,10 +52,10 @@ public class CSRFTokenFilter implements Filter {
|
|
|
if (ADMIN_LOGIN_URL == null) {
|
|
|
ADMIN_LOGIN_URL = request.getServletContext().getContextPath() + "/loginUI";
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
HttpServletRequest req = (HttpServletRequest) request;
|
|
|
HttpServletResponse resp = (HttpServletResponse) response;
|
|
|
-
|
|
|
+
|
|
|
// 当前请求uri
|
|
|
String uri = req.getRequestURI();
|
|
|
// 是否请求登录页面,如果是,那么创建数据,放行。
|
|
@@ -65,7 +65,7 @@ public class CSRFTokenFilter implements Filter {
|
|
|
chain.doFilter(req, resp);
|
|
|
return;
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
// 是否请求后台页面数据,如果是不放行,继续判断,如果是请求后台的静态资源,那么放行
|
|
|
if (!isAdminPage(uri)) {
|
|
|
chain.doFilter(req, resp);return;
|
|
@@ -78,15 +78,15 @@ public class CSRFTokenFilter implements Filter {
|
|
|
}
|
|
|
chain.doFilter(req, resp);
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
* 是否为后台页面请求
|
|
|
* @param uri
|
|
|
*/
|
|
|
public boolean isAdminPage(String uri) {
|
|
|
-
|
|
|
+
|
|
|
if (StringUtils.lastIndexOfAny(uri, "png", "jpg", "jpeg", "js", "css", "ttf", "wttf") != -1) return false;
|
|
|
-
|
|
|
+
|
|
|
if (uri.contains("admin")) return true;
|
|
|
return false;
|
|
|
}
|
|
@@ -99,7 +99,7 @@ public class CSRFTokenFilter implements Filter {
|
|
|
if (uri.contains(ADMIN_LOGIN_URL)) return true;
|
|
|
return false;
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
* 处理后台页面请求
|
|
|
* @param request
|
|
@@ -113,7 +113,7 @@ public class CSRFTokenFilter implements Filter {
|
|
|
String TIME_KEY = (String) request.getSession().getAttribute("4");
|
|
|
String SESSION_KEY = (String) request.getSession().getAttribute("5");
|
|
|
String SIGN_KEY = (String) request.getSession().getAttribute("6");
|
|
|
-
|
|
|
+
|
|
|
String token = null, ip = null, userAgent = null, timestamp = null, sessionId = null, signature = null;
|
|
|
Cookie[] cookies = request.getCookies();
|
|
|
for(Cookie cookie : cookies){
|
|
@@ -131,7 +131,7 @@ public class CSRFTokenFilter implements Filter {
|
|
|
signature = cookie.getValue();
|
|
|
}
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
if (StringUtils.isEmpty(token) || StringUtils.isEmpty(ip) || StringUtils.isEmpty(userAgent) || StringUtils.isEmpty(timestamp) || StringUtils.isEmpty(sessionId) || StringUtils.isEmpty(signature)) {
|
|
|
return false;
|
|
|
}
|
|
@@ -145,13 +145,13 @@ public class CSRFTokenFilter implements Filter {
|
|
|
return false;
|
|
|
}
|
|
|
} catch (Exception e) {e.printStackTrace();}
|
|
|
-
|
|
|
+
|
|
|
String ipTemp = IpAddressUtil.getIpAddr(request);
|
|
|
ipTemp = StringUtils.isEmpty(ipTemp) ? "proxyClientIp" : StringUtils.replace(ipTemp, ".", "");
|
|
|
if (!StringUtils.equals(ip, ipTemp)) {
|
|
|
return false;
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
// 是否超时
|
|
|
try {
|
|
|
Long date = Long.parseLong(timestamp);
|
|
@@ -164,14 +164,14 @@ public class CSRFTokenFilter implements Filter {
|
|
|
return false;
|
|
|
}
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
* 保存用户校验所需的数据
|
|
|
* @param request
|
|
|
- * @throws Exception
|
|
|
+ * @throws Exception
|
|
|
*/
|
|
|
public static void savesSignatureToToken(HttpServletRequest request, HttpServletResponse response) {
|
|
|
-
|
|
|
+
|
|
|
// 如果已经存在值,不要变更名称保存,否则最后会导致cookie过多,tomcat直接返回400; 如果不存在,那么随机产生,防止被猜测
|
|
|
String TOKEN_KEY = (String) request.getSession().getAttribute("1");
|
|
|
String IP_KEY = (String) request.getSession().getAttribute("2");
|
|
@@ -240,7 +240,7 @@ public class CSRFTokenFilter implements Filter {
|
|
|
cookie.setHttpOnly(true); // 不允许页面读取cookie,此方法不安全,最终保证还是取决浏览器,某些浏览器不支持。
|
|
|
response.addCookie(cookie);
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
* 根据name,解析token中的数据
|
|
|
* @param cookieName
|
|
@@ -266,7 +266,7 @@ public class CSRFTokenFilter implements Filter {
|
|
|
* @return
|
|
|
*/
|
|
|
public static String signature(String userAgent, String userIp,
|
|
|
- String format, String token, String timestamp, String sessionId) {
|
|
|
+ String format, String token, String timestamp, String sessionId) {
|
|
|
// 准备签名模版
|
|
|
String signatureTemp = String.format(SIGNATURE_SIMPLE, userAgent, userIp, token, timestamp, sessionId);
|
|
|
// md5签名
|
|
@@ -299,7 +299,7 @@ public class CSRFTokenFilter implements Filter {
|
|
|
return UUID.randomUUID().toString().getBytes();
|
|
|
}
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
* 获取一个安全的随机数
|
|
|
* @return
|
|
@@ -320,7 +320,7 @@ public class CSRFTokenFilter implements Filter {
|
|
|
return hs.toUpperCase();
|
|
|
}
|
|
|
|
|
|
- public CSRFTokenFilter() {}
|
|
|
+ public CSRFTokenFilter() {}
|
|
|
public void destroy() {}
|
|
|
public void init(FilterConfig fConfig) throws ServletException {}
|
|
|
}
|