chenrui
/
zdxtLawEnforcementCode
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
Browse Source

拦截器影响到app跨域的代码部分, 需要修改

v2
蟑螂恶霸 3 years ago
parent
c479c75264
commit
91375e8484
5 changed files with 181 additions and 180 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 7
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java
  2. 162
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java
  3. 74
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java
  4. 2
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java
  5. 116
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java

7
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java
View File

@ -25,12 +25,13 @@ public class CorsFilter implements Filter {
throws IOException, ServletException {
HttpServletResponse res = (HttpServletResponse) response;
res.addHeader("Access-Control-Allow-Credentials", "true");
res.addHeader("Access-Control-Allow-Origin", "http://10.132.108.3");
res.addHeader("Access-Control-Allow-Origin", ((HttpServletRequest) request).getHeader("origin"));
// res.addHeader("Access-Control-Allow-Origin", "http://10.132.108.3");
res.addHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT");
res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN,token");
res.addHeader("X-Frame-Options", "SAMEORIGIN");
res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN");
User user = ShiroUtils.getSysUser();
// res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN");
// User user = ShiroUtils.getSysUser();
// Map<String,Object> payload = new HashMap<>();
// payload.put("id", user.getUserId());
// payload.put("name", user.getPassword());

162
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java
View File

@ -1,81 +1,81 @@
package com.zdxt.auth.framework.config;
import java.util.Map;
import javax.servlet.DispatcherType;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import com.google.common.collect.Maps;
import com.zdxt.auth.common.utils.StringUtils;
import com.zdxt.auth.common.xss.XssFilter;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.filter.CorsFilter;
/**
* Filter配置
*
* @author ruoyi
*/
@Configuration
public class FilterConfig
{
@Value("${xss.enabled}")
private String enabled;
@Value("${xss.excludes}")
private String excludes;
@Value("${xss.urlPatterns}")
private String urlPatterns;
//http host头攻击漏洞处理过滤器
@Autowired
HostFilter hostFilter;
@SuppressWarnings({ "rawtypes", "unchecked" })
@Bean
public FilterRegistrationBean xssFilterRegistration()
{
FilterRegistrationBean registration = new FilterRegistrationBean();
registration.setDispatcherTypes(DispatcherType.REQUEST);
registration.setFilter(new XssAndSqlFilter());
registration.addUrlPatterns(StringUtils.split(urlPatterns, ","));
registration.setName("xssFilter");
registration.setOrder(Integer.MAX_VALUE);
Map<String, String> initParameters = Maps.newHashMap();
initParameters.put("excludes", excludes);
initParameters.put("enabled", enabled);
registration.setInitParameters(initParameters);
return registration;
}
@Bean
public FilterRegistrationBean hostfilter() {
FilterRegistrationBean registration = new FilterRegistrationBean();
registration.setFilter(hostFilter);
registration.addUrlPatterns("/*");
registration.setName("hostFilter");
registration.setOrder(1); // 值越小，Filter越靠前。
return registration;
}
@Bean
public FilterRegistrationBean corsNewFilter() {
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
CorsConfiguration config = new CorsConfiguration();
config.setAllowCredentials(true);
config.addAllowedOrigin("http://10.132.108.3:85");
config.addAllowedOrigin("http://10.132.108.3:80");
config.addAllowedOrigin("http://10.132.108.3:81");
config.addAllowedHeader("*");
config.addAllowedMethod("*");
source.registerCorsConfiguration("/**", config); // CORS 配置对所有接口都有效
FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
bean.setOrder(0);
return bean;
}
}
//package com.zdxt.auth.framework.config;
//
//import java.util.Map;
//import javax.servlet.DispatcherType;
//
//import org.springframework.beans.factory.annotation.Autowired;
//import org.springframework.beans.factory.annotation.Value;
//import org.springframework.boot.web.servlet.FilterRegistrationBean;
//import org.springframework.context.annotation.Bean;
//import org.springframework.context.annotation.Configuration;
//import com.google.common.collect.Maps;
//import com.zdxt.auth.common.utils.StringUtils;
//import com.zdxt.auth.common.xss.XssFilter;
//import org.springframework.web.cors.CorsConfiguration;
//import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
//import org.springframework.web.filter.CorsFilter;
//
///**
// * Filter配置
// *
// * @author ruoyi
// */
//@Configuration
//public class FilterConfig
//{
// @Value("${xss.enabled}")
// private String enabled;
//
// @Value("${xss.excludes}")
// private String excludes;
//
// @Value("${xss.urlPatterns}")
// private String urlPatterns;
//
// //http host头攻击漏洞处理过滤器
// @Autowired
// HostFilter hostFilter;
//
// @SuppressWarnings({ "rawtypes", "unchecked" })
// @Bean
// public FilterRegistrationBean xssFilterRegistration()
// {
// FilterRegistrationBean registration = new FilterRegistrationBean();
// registration.setDispatcherTypes(DispatcherType.REQUEST);
// registration.setFilter(new XssAndSqlFilter());
// registration.addUrlPatterns(StringUtils.split(urlPatterns, ","));
// registration.setName("xssFilter");
// registration.setOrder(Integer.MAX_VALUE);
// Map<String, String> initParameters = Maps.newHashMap();
// initParameters.put("excludes", excludes);
// initParameters.put("enabled", enabled);
// registration.setInitParameters(initParameters);
// return registration;
// }
// @Bean
// public FilterRegistrationBean hostfilter() {
// FilterRegistrationBean registration = new FilterRegistrationBean();
// registration.setFilter(hostFilter);
// registration.addUrlPatterns("/*");
// registration.setName("hostFilter");
// registration.setOrder(1); // 值越小，Filter越靠前。
// return registration;
// }
// @Bean
// public FilterRegistrationBean corsNewFilter() {
// UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
// CorsConfiguration config = new CorsConfiguration();
// config.setAllowCredentials(true);
// config.addAllowedOrigin("http://10.132.108.3:85");
// config.addAllowedOrigin("http://10.132.108.3:80");
// config.addAllowedOrigin("http://10.132.108.3:81");
// config.addAllowedHeader("*");
// config.addAllowedMethod("*");
// source.registerCorsConfiguration("/**", config); // CORS 配置对所有接口都有效
// FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
// bean.setOrder(0);
// return bean;
// }
//
//
//}

74
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java
View File

@ -1,37 +1,37 @@
package com.zdxt.auth.framework.config;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import java.util.Arrays;
@Configuration
public class GlobalCorsConfig {
@Bean
public FilterRegistrationBean<org.springframework.web.filter.CorsFilter> corsfilter() {
FilterRegistrationBean<org.springframework.web.filter.CorsFilter> corsFilterFilterRegistrationBean = new FilterRegistrationBean<>();
//添加CORS配置信息
CorsConfiguration corsConfiguration = new CorsConfiguration();
//允许的域，不要写*，否则cookie就无法使用了
corsConfiguration.addAllowedOrigin("http://10.132.108.3");
//允许的头信息
corsConfiguration.addAllowedHeader("*");
//允许的请求方式
corsConfiguration.setAllowedMethods(Arrays.asList("POST", "PUT", "GET", "DELETE"));
//是否发送cookie信息
corsConfiguration.setAllowCredentials(true);
//预检请求的有效期，单位为秒
corsConfiguration.setMaxAge(3600L);
//添加映射路径，标识待拦截的请求
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", corsConfiguration);
corsFilterFilterRegistrationBean.setFilter(new org.springframework.web.filter.CorsFilter(source));
corsFilterFilterRegistrationBean.setOrder(-1);
return corsFilterFilterRegistrationBean;
}
}
//package com.zdxt.auth.framework.config;
//
//import org.springframework.boot.web.servlet.FilterRegistrationBean;
//import org.springframework.context.annotation.Bean;
//import org.springframework.context.annotation.Configuration;
//import org.springframework.web.cors.CorsConfiguration;
//import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
//
//import java.util.Arrays;
//
//@Configuration
//public class GlobalCorsConfig {
// @Bean
// public FilterRegistrationBean<org.springframework.web.filter.CorsFilter> corsfilter() {
// FilterRegistrationBean<org.springframework.web.filter.CorsFilter> corsFilterFilterRegistrationBean = new FilterRegistrationBean<>();
// //添加CORS配置信息
// CorsConfiguration corsConfiguration = new CorsConfiguration();
// //允许的域，不要写*，否则cookie就无法使用了
// corsConfiguration.addAllowedOrigin("http://10.132.108.3");
// //允许的头信息
// corsConfiguration.addAllowedHeader("*");
// //允许的请求方式
// corsConfiguration.setAllowedMethods(Arrays.asList("POST", "PUT", "GET", "DELETE"));
// //是否发送cookie信息
// corsConfiguration.setAllowCredentials(true);
// //预检请求的有效期，单位为秒
// corsConfiguration.setMaxAge(3600L);
//
// //添加映射路径，标识待拦截的请求
// UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
// source.registerCorsConfiguration("/**", corsConfiguration);
//
// corsFilterFilterRegistrationBean.setFilter(new org.springframework.web.filter.CorsFilter(source));
// corsFilterFilterRegistrationBean.setOrder(-1);
// return corsFilterFilterRegistrationBean;
// }
//}

2
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java
View File

@ -52,7 +52,7 @@ public class ResourcesConfig implements WebMvcConfigurer
.allowedHeaders("*") //允许的请求头
.allowedMethods("GET", "POST", "PUT", "DELETE") //允许的请求方法
.maxAge(1800) //探测请求的有效期
.allowedOrigins("http://10.132.108.3:85","http://10.76.108.1:85"); //支持的域
.allowedOrigins("http://10.132.108.3:85","http://10.76.108.1:85","http://192.168.31.71:85"); //支持的域
}
/**

116
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java
View File

@ -1,58 +1,58 @@
package com.zdxt.auth.framework.config;
import org.apache.catalina.Context;
import org.apache.tomcat.util.descriptor.web.SecurityCollection;
import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
import org.apache.tomcat.util.http.Rfc6265CookieProcessor;
import org.apache.tomcat.util.http.SameSiteCookies;
import org.springframework.boot.web.embedded.tomcat.TomcatContextCustomizer;
import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
import org.springframework.boot.web.servlet.server.ServletWebServerFactory;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
@Configuration
public class TomcatConfig {
@Bean
public ServletWebServerFactory servletContainer() {
TomcatServletWebServerFactory tomcatServletContainerFactory = new TomcatServletWebServerFactory();
tomcatServletContainerFactory.addContextCustomizers(new TomcatContextCustomizer(){
@Override
public void customize(Context context) {
SecurityConstraint constraint = new SecurityConstraint();
SecurityCollection collection = new SecurityCollection();
//http方法
collection.addMethod("PUT");
collection.addMethod("DELETE");
collection.addMethod("HEAD");
// collection.addMethod("OPTIONS");
collection.addMethod("TRACE");
//url匹配表达式 所有路径
collection.addPattern("/*");
constraint.addCollection(collection);
//设置以上HTTP方法在指定路径下需要身份验证约束
constraint.setAuthConstraint(true);
context.addConstraint(constraint);
//设置使用httpOnly
context.setUseHttpOnly(true);
}
});
return tomcatServletContainerFactory;
}
//tomcat配置
@Bean
public TomcatContextCustomizer sameSiteCookiesConfig() {
return context -> {
final Rfc6265CookieProcessor cookieProcessor = new Rfc6265CookieProcessor();
// 设置Cookie的SameSite
cookieProcessor.setSameSiteCookies(SameSiteCookies.STRICT.getValue());
context.setCookieProcessor(cookieProcessor);
};
}
}
//package com.zdxt.auth.framework.config;
//
//import org.apache.catalina.Context;
//import org.apache.tomcat.util.descriptor.web.SecurityCollection;
//import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
//import org.apache.tomcat.util.http.Rfc6265CookieProcessor;
//import org.apache.tomcat.util.http.SameSiteCookies;
//import org.springframework.boot.web.embedded.tomcat.TomcatContextCustomizer;
//import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
//import org.springframework.boot.web.servlet.server.ServletWebServerFactory;
//import org.springframework.context.annotation.Bean;
//import org.springframework.context.annotation.Configuration;
//
//@Configuration
//public class TomcatConfig {
//
// @Bean
// public ServletWebServerFactory servletContainer() {
//
// TomcatServletWebServerFactory tomcatServletContainerFactory = new TomcatServletWebServerFactory();
//
// tomcatServletContainerFactory.addContextCustomizers(new TomcatContextCustomizer(){
//
// @Override
// public void customize(Context context) {
// SecurityConstraint constraint = new SecurityConstraint();
// SecurityCollection collection = new SecurityCollection();
// //http方法
// collection.addMethod("PUT");
// collection.addMethod("DELETE");
// collection.addMethod("HEAD");
//// collection.addMethod("OPTIONS");
// collection.addMethod("TRACE");
// //url匹配表达式 所有路径
// collection.addPattern("/*");
// constraint.addCollection(collection);
// //设置以上HTTP方法在指定路径下需要身份验证约束
// constraint.setAuthConstraint(true);
// context.addConstraint(constraint);
//
// //设置使用httpOnly
// context.setUseHttpOnly(true);
// }
// });
// return tomcatServletContainerFactory;
// }
// //tomcat配置
// @Bean
// public TomcatContextCustomizer sameSiteCookiesConfig() {
// return context -> {
// final Rfc6265CookieProcessor cookieProcessor = new Rfc6265CookieProcessor();
// // 设置Cookie的SameSite
// cookieProcessor.setSameSiteCookies(SameSiteCookies.STRICT.getValue());
// context.setCookieProcessor(cookieProcessor);
// };
// }
//}
//

Write Preview
Loading…
Cancel
Save