chenrui
/
zdxtLawEnforcementCode
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
Browse Source

拦截器影响到app跨域的代码部分, 需要修改

v2
蟑螂恶霸 3 years ago
parent
c479c75264
commit
91375e8484
5 changed files with 181 additions and 180 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 7
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java
  2. 162
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java
  3. 74
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java
  4. 2
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java
  5. 116
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java

7
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java
View File

@ -25,12 +25,13 @@ public class CorsFilter implements Filter {
throws IOException, ServletException { throws IOException, ServletException {
HttpServletResponse res = (HttpServletResponse) response; HttpServletResponse res = (HttpServletResponse) response;
res.addHeader("Access-Control-Allow-Credentials", "true"); res.addHeader("Access-Control-Allow-Credentials", "true");
res.addHeader("Access-Control-Allow-Origin", "http://10.132.108.3"); res.addHeader("Access-Control-Allow-Origin", ((HttpServletRequest) request).getHeader("origin"));
// res.addHeader("Access-Control-Allow-Origin", "http://10.132.108.3");
res.addHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT"); res.addHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT");
res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN,token"); res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN,token");
res.addHeader("X-Frame-Options", "SAMEORIGIN"); res.addHeader("X-Frame-Options", "SAMEORIGIN");
res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN"); // res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN");
User user = ShiroUtils.getSysUser(); // User user = ShiroUtils.getSysUser();
// Map<String,Object> payload = new HashMap<>(); // Map<String,Object> payload = new HashMap<>();
// payload.put("id", user.getUserId()); // payload.put("id", user.getUserId());
// payload.put("name", user.getPassword()); // payload.put("name", user.getPassword());

162
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java
View File

@ -1,81 +1,81 @@
package com.zdxt.auth.framework.config; //package com.zdxt.auth.framework.config;
//
import java.util.Map; //import java.util.Map;
import javax.servlet.DispatcherType; //import javax.servlet.DispatcherType;
//
import org.springframework.beans.factory.annotation.Autowired; //import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value; //import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.web.servlet.FilterRegistrationBean; //import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean; //import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration; //import org.springframework.context.annotation.Configuration;
import com.google.common.collect.Maps; //import com.google.common.collect.Maps;
import com.zdxt.auth.common.utils.StringUtils; //import com.zdxt.auth.common.utils.StringUtils;
import com.zdxt.auth.common.xss.XssFilter; //import com.zdxt.auth.common.xss.XssFilter;
import org.springframework.web.cors.CorsConfiguration; //import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource; //import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.filter.CorsFilter; //import org.springframework.web.filter.CorsFilter;
//
/** ///**
* Filter配置 // * Filter配置
* // *
* @author ruoyi // * @author ruoyi
*/ // */
@Configuration //@Configuration
public class FilterConfig //public class FilterConfig
{ //{
@Value("${xss.enabled}") // @Value("${xss.enabled}")
private String enabled; // private String enabled;
//
@Value("${xss.excludes}") // @Value("${xss.excludes}")
private String excludes; // private String excludes;
//
@Value("${xss.urlPatterns}") // @Value("${xss.urlPatterns}")
private String urlPatterns; // private String urlPatterns;
//
//http host头攻击漏洞处理过滤器 // //http host头攻击漏洞处理过滤器
@Autowired // @Autowired
HostFilter hostFilter; // HostFilter hostFilter;
//
@SuppressWarnings({ "rawtypes", "unchecked" }) // @SuppressWarnings({ "rawtypes", "unchecked" })
@Bean // @Bean
public FilterRegistrationBean xssFilterRegistration() // public FilterRegistrationBean xssFilterRegistration()
{ // {
FilterRegistrationBean registration = new FilterRegistrationBean(); // FilterRegistrationBean registration = new FilterRegistrationBean();
registration.setDispatcherTypes(DispatcherType.REQUEST); // registration.setDispatcherTypes(DispatcherType.REQUEST);
registration.setFilter(new XssAndSqlFilter()); // registration.setFilter(new XssAndSqlFilter());
registration.addUrlPatterns(StringUtils.split(urlPatterns, ",")); // registration.addUrlPatterns(StringUtils.split(urlPatterns, ","));
registration.setName("xssFilter"); // registration.setName("xssFilter");
registration.setOrder(Integer.MAX_VALUE); // registration.setOrder(Integer.MAX_VALUE);
Map<String, String> initParameters = Maps.newHashMap(); // Map<String, String> initParameters = Maps.newHashMap();
initParameters.put("excludes", excludes); // initParameters.put("excludes", excludes);
initParameters.put("enabled", enabled); // initParameters.put("enabled", enabled);
registration.setInitParameters(initParameters); // registration.setInitParameters(initParameters);
return registration; // return registration;
} // }
@Bean // @Bean
public FilterRegistrationBean hostfilter() { // public FilterRegistrationBean hostfilter() {
FilterRegistrationBean registration = new FilterRegistrationBean(); // FilterRegistrationBean registration = new FilterRegistrationBean();
registration.setFilter(hostFilter); // registration.setFilter(hostFilter);
registration.addUrlPatterns("/*"); // registration.addUrlPatterns("/*");
registration.setName("hostFilter"); // registration.setName("hostFilter");
registration.setOrder(1); // 值越小，Filter越靠前。 // registration.setOrder(1); // 值越小，Filter越靠前。
return registration; // return registration;
} // }
@Bean // @Bean
public FilterRegistrationBean corsNewFilter() { // public FilterRegistrationBean corsNewFilter() {
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); // UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
CorsConfiguration config = new CorsConfiguration(); // CorsConfiguration config = new CorsConfiguration();
config.setAllowCredentials(true); // config.setAllowCredentials(true);
config.addAllowedOrigin("http://10.132.108.3:85"); // config.addAllowedOrigin("http://10.132.108.3:85");
config.addAllowedOrigin("http://10.132.108.3:80"); // config.addAllowedOrigin("http://10.132.108.3:80");
config.addAllowedOrigin("http://10.132.108.3:81"); // config.addAllowedOrigin("http://10.132.108.3:81");
config.addAllowedHeader("*"); // config.addAllowedHeader("*");
config.addAllowedMethod("*"); // config.addAllowedMethod("*");
source.registerCorsConfiguration("/**", config); // CORS 配置对所有接口都有效 // source.registerCorsConfiguration("/**", config); // CORS 配置对所有接口都有效
FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source)); // FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
bean.setOrder(0); // bean.setOrder(0);
return bean; // return bean;
} // }
//
//
} //}

74
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java
View File

@ -1,37 +1,37 @@
package com.zdxt.auth.framework.config; //package com.zdxt.auth.framework.config;
//
import org.springframework.boot.web.servlet.FilterRegistrationBean; //import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean; //import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration; //import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration; //import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource; //import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
//
import java.util.Arrays; //import java.util.Arrays;
//
@Configuration //@Configuration
public class GlobalCorsConfig { //public class GlobalCorsConfig {
@Bean // @Bean
public FilterRegistrationBean<org.springframework.web.filter.CorsFilter> corsfilter() { // public FilterRegistrationBean<org.springframework.web.filter.CorsFilter> corsfilter() {
FilterRegistrationBean<org.springframework.web.filter.CorsFilter> corsFilterFilterRegistrationBean = new FilterRegistrationBean<>(); // FilterRegistrationBean<org.springframework.web.filter.CorsFilter> corsFilterFilterRegistrationBean = new FilterRegistrationBean<>();
//添加CORS配置信息 // //添加CORS配置信息
CorsConfiguration corsConfiguration = new CorsConfiguration(); // CorsConfiguration corsConfiguration = new CorsConfiguration();
//允许的域，不要写*，否则cookie就无法使用了 // //允许的域，不要写*，否则cookie就无法使用了
corsConfiguration.addAllowedOrigin("http://10.132.108.3"); // corsConfiguration.addAllowedOrigin("http://10.132.108.3");
//允许的头信息 // //允许的头信息
corsConfiguration.addAllowedHeader("*"); // corsConfiguration.addAllowedHeader("*");
//允许的请求方式 // //允许的请求方式
corsConfiguration.setAllowedMethods(Arrays.asList("POST", "PUT", "GET", "DELETE")); // corsConfiguration.setAllowedMethods(Arrays.asList("POST", "PUT", "GET", "DELETE"));
//是否发送cookie信息 // //是否发送cookie信息
corsConfiguration.setAllowCredentials(true); // corsConfiguration.setAllowCredentials(true);
//预检请求的有效期，单位为秒 // //预检请求的有效期，单位为秒
corsConfiguration.setMaxAge(3600L); // corsConfiguration.setMaxAge(3600L);
//
//添加映射路径，标识待拦截的请求 // //添加映射路径，标识待拦截的请求
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); // UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", corsConfiguration); // source.registerCorsConfiguration("/**", corsConfiguration);
//
corsFilterFilterRegistrationBean.setFilter(new org.springframework.web.filter.CorsFilter(source)); // corsFilterFilterRegistrationBean.setFilter(new org.springframework.web.filter.CorsFilter(source));
corsFilterFilterRegistrationBean.setOrder(-1); // corsFilterFilterRegistrationBean.setOrder(-1);
return corsFilterFilterRegistrationBean; // return corsFilterFilterRegistrationBean;
} // }
} //}

2
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java
View File

@ -52,7 +52,7 @@ public class ResourcesConfig implements WebMvcConfigurer
.allowedHeaders("*") //允许的请求头 .allowedHeaders("*") //允许的请求头
.allowedMethods("GET", "POST", "PUT", "DELETE") //允许的请求方法 .allowedMethods("GET", "POST", "PUT", "DELETE") //允许的请求方法
.maxAge(1800) //探测请求的有效期 .maxAge(1800) //探测请求的有效期
.allowedOrigins("http://10.132.108.3:85","http://10.76.108.1:85"); //支持的域 .allowedOrigins("http://10.132.108.3:85","http://10.76.108.1:85","http://192.168.31.71:85"); //支持的域
} }
/** /**

116
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java
View File

@ -1,58 +1,58 @@
package com.zdxt.auth.framework.config; //package com.zdxt.auth.framework.config;
//
import org.apache.catalina.Context; //import org.apache.catalina.Context;
import org.apache.tomcat.util.descriptor.web.SecurityCollection; //import org.apache.tomcat.util.descriptor.web.SecurityCollection;
import org.apache.tomcat.util.descriptor.web.SecurityConstraint; //import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
import org.apache.tomcat.util.http.Rfc6265CookieProcessor; //import org.apache.tomcat.util.http.Rfc6265CookieProcessor;
import org.apache.tomcat.util.http.SameSiteCookies; //import org.apache.tomcat.util.http.SameSiteCookies;
import org.springframework.boot.web.embedded.tomcat.TomcatContextCustomizer; //import org.springframework.boot.web.embedded.tomcat.TomcatContextCustomizer;
import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory; //import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
import org.springframework.boot.web.servlet.server.ServletWebServerFactory; //import org.springframework.boot.web.servlet.server.ServletWebServerFactory;
import org.springframework.context.annotation.Bean; //import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration; //import org.springframework.context.annotation.Configuration;
//
@Configuration //@Configuration
public class TomcatConfig { //public class TomcatConfig {
//
@Bean // @Bean
public ServletWebServerFactory servletContainer() { // public ServletWebServerFactory servletContainer() {
//
TomcatServletWebServerFactory tomcatServletContainerFactory = new TomcatServletWebServerFactory(); // TomcatServletWebServerFactory tomcatServletContainerFactory = new TomcatServletWebServerFactory();
//
tomcatServletContainerFactory.addContextCustomizers(new TomcatContextCustomizer(){ // tomcatServletContainerFactory.addContextCustomizers(new TomcatContextCustomizer(){
//
@Override // @Override
public void customize(Context context) { // public void customize(Context context) {
SecurityConstraint constraint = new SecurityConstraint(); // SecurityConstraint constraint = new SecurityConstraint();
SecurityCollection collection = new SecurityCollection(); // SecurityCollection collection = new SecurityCollection();
//http方法 // //http方法
collection.addMethod("PUT"); // collection.addMethod("PUT");
collection.addMethod("DELETE"); // collection.addMethod("DELETE");
collection.addMethod("HEAD"); // collection.addMethod("HEAD");
// collection.addMethod("OPTIONS"); //// collection.addMethod("OPTIONS");
collection.addMethod("TRACE"); // collection.addMethod("TRACE");
//url匹配表达式 所有路径 // //url匹配表达式 所有路径
collection.addPattern("/*"); // collection.addPattern("/*");
constraint.addCollection(collection); // constraint.addCollection(collection);
//设置以上HTTP方法在指定路径下需要身份验证约束 // //设置以上HTTP方法在指定路径下需要身份验证约束
constraint.setAuthConstraint(true); // constraint.setAuthConstraint(true);
context.addConstraint(constraint); // context.addConstraint(constraint);
//
//设置使用httpOnly // //设置使用httpOnly
context.setUseHttpOnly(true); // context.setUseHttpOnly(true);
} // }
}); // });
return tomcatServletContainerFactory; // return tomcatServletContainerFactory;
} // }
//tomcat配置 // //tomcat配置
@Bean // @Bean
public TomcatContextCustomizer sameSiteCookiesConfig() { // public TomcatContextCustomizer sameSiteCookiesConfig() {
return context -> { // return context -> {
final Rfc6265CookieProcessor cookieProcessor = new Rfc6265CookieProcessor(); // final Rfc6265CookieProcessor cookieProcessor = new Rfc6265CookieProcessor();
// 设置Cookie的SameSite // // 设置Cookie的SameSite
cookieProcessor.setSameSiteCookies(SameSiteCookies.STRICT.getValue()); // cookieProcessor.setSameSiteCookies(SameSiteCookies.STRICT.getValue());
context.setCookieProcessor(cookieProcessor); // context.setCookieProcessor(cookieProcessor);
}; // };
} // }
} //}
//

Write Preview
Loading…
Cancel
Save