|
- package com.iformall.interceptor;
-
- import com.iformall.utils.UrlCheck;
- import org.slf4j.Logger;
- import org.slf4j.LoggerFactory;
-
- import javax.servlet.*;
- import javax.servlet.http.HttpServletRequest;
- import java.io.IOException;
-
- public class HttpServletRequestWrapperFilter implements Filter {
- private static final Logger logger = LoggerFactory.getLogger(HttpServletRequestWrapperFilter.class);
- // 多个跨域域名设置
- // public static final String[] ALLOW_DOMAIN = {"https://admin.malls.iformall.com"};
-
- @Override
- public void init(FilterConfig filterConfig) throws ServletException {
-
- }
-
- @Override
- public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
- throws IOException, ServletException {
-
- ServletRequest requestWrapper = null;
- /* // 跨域访问
- HttpServletRequest req = (HttpServletRequest) request;
- HttpServletResponse res = (HttpServletResponse) response;
- String originHeader = req.getHeader("Origin");
-
- if (Arrays.asList(ALLOW_DOMAIN).contains(originHeader)) {
- //通过在响应 header 中设置 ‘*’ 来允许来自所有域的跨域请求访问。
- res.setHeader("Access-Control-Allow-Origin", originHeader);
- //通过对 Credentials 参数的设置,就可以保持跨域 Ajax 时的 Cookie
- //设置了Allow-Credentials,Allow-Origin就不能为*,需要指明具体的url域
- res.setHeader("Access-Control-Allow-Credentials", "true");
- //请求方式
- res.setHeader("Access-Control-Allow-Methods", "*");
- //(预检请求)的返回结果(即 Access-Control-Allow-Methods 和Access-Control-Allow-Headers 提供的信息) 可以被缓存多久
- res.setHeader("Access-Control-Max-Age", "86400");
- //首部字段用于预检请求的响应。其指明了实际请求中允许携带的首部字段
- //res.setHeader("Access-Control-Allow-Headers", "*");
- res.setHeader("Access-Control-Allow-Headers",
- "Timestamp,Origin, No-Cache, X-Requested-With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With,userId,token,Access-Control-Allow-Headers");
- }
- */
-
- //sql,xss过滤
- XssHttpServletRequestWrapper xssHttpServletRequestWrapper = new XssHttpServletRequestWrapper((HttpServletRequest)request);
-
- if (request instanceof HttpServletRequest) {
- String url = ((HttpServletRequest) request).getRequestURI();
- if (!UrlCheck.checkUrl(url)) {
- requestWrapper = new BodyReaderHttpServletRequestWrapper((HttpServletRequest) request);
- }
- }
- if (null == requestWrapper) {
- chain.doFilter(xssHttpServletRequestWrapper, response);
- } else {
- chain.doFilter(requestWrapper, response);
- }
-
- }
-
-
- @Override
- public void destroy() {
-
- }
- }
|