org.frameworkset.web.token

Class TokenFilter

java.lang.Object

org.frameworkset.web.token.TokenFilter

All Implemented Interfaces:

javax.servlet.Filter

Direct Known Subclasses:

AuthenticateFilter

public class TokenFilter
extends java.lang.Object
implements javax.servlet.Filter

防止跨站请求过滤器 bboss防止跨站请求过滤器的机制如下： 采用动态令牌和session相结合的方式产生客户端令牌，一次请求产生一个唯一令牌 令牌识别采用客户端令牌和服务端session标识混合的方式进行判别，如果客户端令牌和服务端令牌正确匹配，则允许访问，否则认为用户为非法用户并阻止用户访问并跳转到 redirectpath参数对应的地址，默认为/login.jsp。 令牌存储机制通过参数tokenstore指定，包括两种，内存存储和session存储，默认为session存储，当令牌失效（匹配后立即失效，或者超时失效）后，系统自动清除失效的令牌；采用session方式 存储令牌时，如果客户端页面没有启用session，那么令牌还是会存储在内存中。 令牌生命周期：客户端的令牌在服务器端留有存根，当令牌失效（匹配后立即失效，或者超时失效）后，系统自动清除失效的令牌； 当客户端并没有正确提交请求，会导致服务端令牌存根变为垃圾令牌，需要定时清除这些 垃圾令牌；如果令牌存储在session中，那么令牌的生命周期和session的生命周期保持一致，无需额外清除机制； 如果令牌存储在内存中，那么令牌的清除由令牌管理组件自己定时扫描清除，定时扫描时间间隔为由tokenscaninterval参数指定，单位为毫秒，默认为30分钟，存根保存时间由tokendualtime参数指定，默认为1个小时 可以通过enableToken参数配置指定是否启用令牌检测机制，true检测，false不检测，默认为false不检测

Field Summary

Fields

Modifier and Type	Field and Description
protected java.lang.String	redirectpath

Constructor Summary

Constructors

Constructor and Description
TokenFilter()

Method Summary

Modifier and Type	Method and Description
protected java.lang.String	appendDTokenToTargetURL(javax.servlet.http.HttpServletRequest request, java.lang.String targetUrl)
static void	assertDToken(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, org.frameworkset.util.annotations.MethodData handlerMethod)
protected boolean	checkTokenExist(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)
void	destroy()
void	doDTokencheck(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response)
void	doFilter(javax.servlet.ServletRequest arg0, javax.servlet.ServletResponse arg1, javax.servlet.FilterChain arg2)
void	doTicketcheck(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response)
protected boolean	firstRequest(javax.servlet.ServletRequest request) 判断令牌或者ticket是否有效，一次请求只判断一次，避免多次判断 同时记录判断结果，以便后续处理操作获取这个结果进行相应的处理
java.lang.String	getRedirecturl()
void	init(javax.servlet.FilterConfig arg0) tokenstore 指定令牌存储机制，目前提供两种机制： mem：将令牌直接存储在内存空间中 session：将令牌存储在session中 默认存储在session中
protected boolean	isloopredirect(javax.servlet.http.HttpServletRequest request, java.lang.String targetUrl)
void	sendRedirect(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)
protected void	sendRedirect(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, java.lang.String targetUrl, boolean http10Compatible, boolean isforward, boolean isinclude)
void	sendRedirect403(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)
void	setRedirecturl(java.lang.String redirecturl)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

redirectpath

protected java.lang.String redirectpath

Constructor Detail

TokenFilter

public TokenFilter()

Method Detail

init

public void init(javax.servlet.FilterConfig arg0)
          throws javax.servlet.ServletException

tokenstore 指定令牌存储机制，目前提供两种机制： mem：将令牌直接存储在内存空间中 session：将令牌存储在session中 默认存储在session中

Specified by:

init in interface javax.servlet.Filter

Throws:

javax.servlet.ServletException

destroy

public void destroy()

Specified by:

destroy in interface javax.servlet.Filter

doFilter

public void doFilter(javax.servlet.ServletRequest arg0,
                     javax.servlet.ServletResponse arg1,
                     javax.servlet.FilterChain arg2)
              throws java.io.IOException,
                     javax.servlet.ServletException

Specified by:

doFilter in interface javax.servlet.Filter

Throws:

java.io.IOException

javax.servlet.ServletException

checkTokenExist

protected boolean checkTokenExist(javax.servlet.http.HttpServletRequest request,
                                  javax.servlet.http.HttpServletResponse response)
                           throws java.lang.Exception

Throws:

java.lang.Exception

sendRedirect

public void sendRedirect(javax.servlet.http.HttpServletRequest request,
                         javax.servlet.http.HttpServletResponse response)
                  throws java.io.IOException

Throws:

java.io.IOException

sendRedirect403

public void sendRedirect403(javax.servlet.http.HttpServletRequest request,
                            javax.servlet.http.HttpServletResponse response)
                     throws java.io.IOException

Throws:

java.io.IOException

appendDTokenToTargetURL

protected java.lang.String appendDTokenToTargetURL(javax.servlet.http.HttpServletRequest request,
                                                   java.lang.String targetUrl)
                                            throws TokenException

Throws:

TokenException

isloopredirect

protected boolean isloopredirect(javax.servlet.http.HttpServletRequest request,
                                 java.lang.String targetUrl)

sendRedirect

protected void sendRedirect(javax.servlet.http.HttpServletRequest request,
                            javax.servlet.http.HttpServletResponse response,
                            java.lang.String targetUrl,
                            boolean http10Compatible,
                            boolean isforward,
                            boolean isinclude)
                     throws java.io.IOException

Throws:

java.io.IOException

getRedirecturl

public java.lang.String getRedirecturl()

setRedirecturl

public void setRedirecturl(java.lang.String redirecturl)

firstRequest

protected boolean firstRequest(javax.servlet.ServletRequest request)

判断令牌或者ticket是否有效，一次请求只判断一次，避免多次判断 同时记录判断结果，以便后续处理操作获取这个结果进行相应的处理

Parameters:

request -

Returns:

doDTokencheck

public void doDTokencheck(javax.servlet.ServletRequest request,
                          javax.servlet.ServletResponse response)
                   throws java.io.IOException,
                          DTokenValidateFailedException

Throws:

java.io.IOException

DTokenValidateFailedException

doTicketcheck

public void doTicketcheck(javax.servlet.ServletRequest request,
                          javax.servlet.ServletResponse response)
                   throws java.io.IOException,
                          DTokenValidateFailedException

Throws:

java.io.IOException

DTokenValidateFailedException

assertDToken

public static void assertDToken(javax.servlet.ServletRequest request,
                                javax.servlet.ServletResponse response,
                                org.frameworkset.util.annotations.MethodData handlerMethod)
                         throws java.io.IOException,
                                DTokenValidateFailedException

Throws:

java.io.IOException

DTokenValidateFailedException