1,防盗链防止盗用自己服务上的东西。。。
2,XSS服务上有这么一张图：
<!DOCTYPE html> <html> <head lang="en"> <meta charset="UTF-8" /> <title></title> </head> <body> <form action="postIndex" method="post"> 输入内容: <input type="text" name="name"> <br> <input type="submit"> </form> <img src="imgs/logo.PNG" alt=""> </body> </html>
SatetyChain 服务上：<img src="http://127.0.0.1:8080/img/logo.PNG" alt=""> 直接把这张图片引用过来，属于盗图，怎么防止这种情况发生呢？
<!DOCTYPE html> <html> <head lang="en"> <meta charset="UTF-8" /> <title></title> </head> <body> <form action="postIndex" method="post"> 输入内容: <input type="text" name="name"> <br> <input type="submit"> </form> <img src="http://127.0.0.1:8080/imgs/logo.PNG" alt=""> </body> </html>
3,防盗链技术实现上面的需求，简单来说，还是通过拦截器，拦截请求，查看请求头Referer记录请求来源，可以查看到请求图片的域名，如果不是指定的域名，让其请求失败
测试：
C:WindowsSystem32driversetchosts
127.0.0.1 www.aiyuesheng.com
package com.aiyuesheng.filter; import java.io.IOException; import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.annotation.WebFilter; import javax.servlet.http.HttpServletRequest; import org.apache.commons.lang.StringUtils; import org.springframework.beans.factory.annotation.Value; @WebFilter(filterName = "imgFilter", urlPatterns = "/imgs/*") public class ImgFilter implements Filter { @Value("${domain.name}") private String domainName; public void init(FilterConfig filterConfig) throws ServletException { } public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest req = (HttpServletRequest) request; String referer = req.getHeader("Referer"); if (StringUtils.isEmpty(referer)) { request.getRequestDispatcher("/imgs/error.png").forward(request, response); return; } String domain = getDomain(referer); //域名里面如果有端口号，为了测试 String domainTemp = domain.contains(":") ? domain.split(":")[0] : domain; if (!domainTemp.equals(domainName)) { request.getRequestDispatcher("/imgs/error.png").forward(request, response); return; } chain.doFilter(request, response); } /** * 获取url对应的域名 * * @param url * @return */ public String getDomain(String url) { String result = ""; int j = 0, startIndex = 0, endIndex = 0; for (int i = 0; i < url.length(); i++) { if (url.charAt(i) == '/') { j++; if (j == 2) startIndex = i; else if (j == 3) endIndex = i; } } result = url.substring(startIndex + 1, endIndex); return result; } public void destroy() { } }
当有其他服务，盗用图片的时候，会拦截请求，查看RequestHeader 里面的Referer 参数：不是匹配的域名，则重定向error.png
