校验Referer头，防范CSRF(跨站请求伪造)攻击的拦截器

?

?

	public final static	String domainName = "192.168.2.123";

?

?

package com.web.interceptors;

import org.apache.log4j.Logger;
import org.apache.struts2.ServletActionContext;

import com.opensymphony.xwork2.ActionInvocation;
import com.opensymphony.xwork2.interceptor.AbstractInterceptor;
import com.trace.web.utils.Constants;

/**
 * 对管理员操作，校验Referer头，防范CSRF(跨站请求伪造)攻击的拦截器
 * @author admin
 */
public class AuthInterceptor extends AbstractInterceptor {

	private static final long serialVersionUID = -2154056039548254482L;
	
	private static Logger log = Logger.getLogger(AuthInterceptor.class);

	@Override
	public String intercept(ActionInvocation invocation) throws Exception {
		String referer = ServletActionContext.getRequest().getHeader("Referer");
		if((referer!=null) && (referer.trim().startsWith(Constants.HTTP + Constants.domainName))){
			return invocation.invoke();
		}
		log.info("referer : " + referer);
		return "error";
	}

}

?

?

?

?

?

?

?

?

?

?

?

?

?

?

校验Referer头，防范CSRF(跨站请求伪造)攻击的拦截器

原文：http://knight-black-bob.iteye.com/blog/2267372