HTTP Referer是header的一部分，當(dāng)瀏覽器向web服務(wù)器發(fā)送請(qǐng)求的時(shí)候厘熟，會(huì)帶上Referer维哈，通過(guò)驗(yàn)證Referer阔挠，可以判斷請(qǐng)求的合法性，如果Referer是其他網(wǎng)站的話迂求，就有可能是CSRF攻擊锁摔，則拒絕該請(qǐng)求。
request.getSchema()可以返回當(dāng)前頁(yè)面使用的協(xié)議孕豹，http 或是 https;
request.getServerName()可以返回當(dāng)前頁(yè)面所在的服務(wù)器的名字;
public class ReferrerInterceptor implements HandlerInterceptor {
static final Logger logger = LogManager.getLogger(ReferrerInterceptor.class);
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
String referrer = request.getHeader("referer");
logger.debug("referrer:{}",referrer);
StringBuffer stringBuffer = new StringBuffer();
stringBuffer.append(request.getScheme()).append("://").append(request.getServerName());
logger.debug("basePath:{}",stringBuffer);
if(referrer==null||referrer.equals("")||referrer.lastIndexOf(String.valueOf(stringBuffer))==0){
return true;
}
else{
return false;
}
}
@Override
public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
}
@Override
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
}
}
