package com.whyc.filter;
|
|
import com.whyc.constant.YamlProperties;
|
import com.whyc.util.ActionUtil;
|
|
import javax.servlet.*;
|
import javax.servlet.annotation.WebFilter;
|
import javax.servlet.http.HttpServletRequest;
|
import javax.servlet.http.HttpServletResponse;
|
import java.io.IOException;
|
|
/**
|
* 防重放功能
|
*/
|
@WebFilter
|
public class AccessFilter implements Filter {
|
@Override
|
public void init(FilterConfig filterConfig) throws ServletException {
|
|
}
|
|
@Override
|
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
|
|
HttpServletRequest request = (HttpServletRequest) servletRequest;
|
HttpServletResponse response = (HttpServletResponse) servletResponse;
|
//加入接口防重放功能
|
String time = request.getParameter("t");
|
String sign = request.getParameter("sign");
|
String randomStr = request.getParameter("rd");
|
|
|
String requestURI = request.getRequestURI();
|
//严格要求
|
if (2 == YamlProperties.systemType) {
|
if (time != null && sign != null && randomStr != null) { //检查接口的防重放功能
|
//60秒内检查randomStr是否存在(60秒后定时清除)
|
//ServletContext context = request.getServletContext();
|
ServletContext context = request.getSession().getServletContext();
|
//如果存在就说明参数在60秒内已经使用过了
|
if (context.getAttribute(randomStr) != null) {
|
response.setStatus(403);
|
response.getWriter().write("非法请求,参数异常");
|
return;
|
} else { //不存在,说明第一次使用,存入内存
|
context.setAttribute(randomStr, time);
|
context.setAttribute("randomStr_" + randomStr, time);
|
}
|
|
//60秒后,检查时效性
|
if (System.currentTimeMillis() - Long.parseLong(time) >= 60 * 1000) {
|
response.setStatus(408);
|
response.getWriter().write("请求超时异常");
|
return;
|
}
|
boolean res = ActionUtil.checkSignMD5(time, randomStr, sign);
|
if (!res) {
|
response.setStatus(403);
|
response.getWriter().write("非法请求,参数异常");
|
return;
|
}
|
} else {
|
if (!(requestURI.contains("server/timestamp")
|
|| requestURI.contains("mapOutline/all")
|
|| requestURI.contains("battMapInformation/findStationState")
|
|| requestURI.contains("battMapInformation/searchUserManageStation")
|
|| requestURI.contains("battMapInformation/del")
|
|| requestURI.contains("station3D/byDeviceId")
|
|| requestURI.contains("battMapInformation/multAmout")
|
|| requestURI.contains("."))) {
|
response.setStatus(403);
|
response.getWriter().write("非法请求,参数异常");
|
return;
|
}
|
}
|
}
|
|
filterChain.doFilter(servletRequest, servletResponse);
|
}
|
|
@Override
|
public void destroy() {
|
|
}
|
}
|
