public abstract class PostBodyTamperProofingChecker extends GetQueryTamperProofingChecker
1. 存在查询参数和Body：
{"body":"{\"d\": \"d\"}","query":"12=dd&a=s&q1=dd"}
2. 只存在Body:
{"body":"{\"d\": \"d\"}"}
3. 只存在查询参数：
{query":"12=dd&a=s&q1=dd"}
将上述JSON对象序列化成字符串，进行防篡改检查。
注意：Java中字符串都是采用双引号括起来的，没有空格和格式化，
而前端JavaScript可以采用单引号和双引号，前端需要采用双引号才能与后端保持一致。| 限定符和类型 | 字段和说明 |
|---|---|
protected org.springframework.http.converter.json.MappingJackson2HttpMessageConverter |
jackson2HttpMessageConverter
序列化JSON类型Body，将Body转换成JSON字符串。
|
logger, textEncryptorDATA_SIGN_HEAER_NAME| 构造器和说明 |
|---|
PostBodyTamperProofingChecker(org.springframework.security.crypto.encrypt.TextEncryptor textEncryptor,
org.springframework.http.converter.json.MappingJackson2HttpMessageConverter jackson2HttpMessageConverter) |
| 限定符和类型 | 方法和说明 |
|---|---|
void |
check(javax.servlet.http.HttpServletRequest request)
当方法
TamperProofingChecker.support(HttpServletRequest) 调用返回true，则需要执行该方法。 |
Object |
convertData(Object value)
对Map中的属性名称进行排序。
|
protected abstract Object |
getBody(javax.servlet.http.HttpServletRequest request)
将POST请求Body序列化成Object对象。
|
protected String |
getBodyAndQueryAsJson(javax.servlet.http.HttpServletRequest request)
将请求数据根据序列化成JSON字符串
|
boolean |
support(javax.servlet.http.HttpServletRequest request)
检查是否需要支持请求数据。
|
protected abstract boolean |
supportInternal(javax.servlet.http.HttpServletRequest request)
子类应该实现该抽象方法，判断是否需要检查HTTP请求。
|
isGetQueryRequest, isIgwClientRequest, isRootRequest, sortQueryString, urlDecodedoValdiate, getSignValueprotected final org.springframework.http.converter.json.MappingJackson2HttpMessageConverter jackson2HttpMessageConverter
public PostBodyTamperProofingChecker(org.springframework.security.crypto.encrypt.TextEncryptor textEncryptor,
org.springframework.http.converter.json.MappingJackson2HttpMessageConverter jackson2HttpMessageConverter)
textEncryptor - jackson2HttpMessageConverter - public boolean support(javax.servlet.http.HttpServletRequest request)
TamperProofingCheckersupport 在接口中 TamperProofingCheckersupport 在类中 GetQueryTamperProofingCheckerrequest - HTTP请求对象public void check(javax.servlet.http.HttpServletRequest request)
throws SafeException
TamperProofingCheckerTamperProofingChecker.support(HttpServletRequest) 调用返回true，则需要执行该方法。
对请求数据进行防篡改检查。check 在接口中 TamperProofingCheckercheck 在类中 GetQueryTamperProofingCheckerrequest - HTTP请求对象SafeException - 检查失败抛出异常。protected abstract boolean supportInternal(javax.servlet.http.HttpServletRequest request)
request - HTTP请求对象protected abstract Object getBody(javax.servlet.http.HttpServletRequest request) throws IOException, javax.servlet.ServletException
ServletRequest.getContentType()序列化Body。request - HTTP请求对象IOException - 操作IO错误javax.servlet.ServletException - 系统错误异常protected String getBodyAndQueryAsJson(javax.servlet.http.HttpServletRequest request)
request - HTTP请求对象Copyright © 2023. All rights reserved.