如何使用Java设置Referer防盗链 Java根据来源设置访问权限示例

import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

@WebServlet("/protectedResource")
public class ProtectedResourceServlet extends HttpServlet {
    private static final long serialVersionUID = 1L;

    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String referer = request.getHeader("Referer");

        // 允许的来源
        String allowedReferer = "http://www.example.com";

        if (referer != null && referer.startsWith(allowedReferer)) {
            // 允许访问，返回资源
            response.getWriter().println("<h1>Welcome! This is your protected resource.</h1>");
        } else {
            // 拒绝访问
            response.sendError(HttpServletResponse.SC_FORBIDDEN, "Access Denied. Invalid Referer.");
        }
    }

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        doGet(request, response);
    }
}

import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

@WebFilter("/*") // 拦截所有请求
public class RefererFilter implements Filter {

    private String allowedReferer;

    public void init(FilterConfig fConfig) throws ServletException {
        allowedReferer = "http://www.example.com"; // 从配置文件读取
    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;

        String referer = httpRequest.getHeader("Referer");

        if (referer != null && referer.startsWith(allowedReferer)) {
            chain.doFilter(request, response); // 继续处理请求
        } else {
            httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN, "Access Denied. Invalid Referer.");
        }
    }

    public void destroy() {
        // cleanup
    }
}

if (referer == null || referer.isEmpty()) {
    // Referer 为空时的处理逻辑
    // 可以选择允许访问，或者拒绝访问
    // 例如：
    // chain.doFilter(request, response); // 允许
    // 或者
    // httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN, "Access Denied. Referer is missing."); // 拒绝
}

String referer = request.getHeader("Referer");

if (referer == null || referer.isEmpty()) {
    // Referer 为空
    // 策略 1：允许访问
    // chain.doFilter(request, response);

    // 策略 2：拒绝访问
    // httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN, "Access Denied. Referer is missing.");

    // 策略 3：提供降级方案
    // response.sendRedirect("/login"); // 跳转到登录页面
    // 或者
    // response.getWriter().println("Please enable Referer in your browser settings.");
} else {
    // Referer 不为空，进行正常的防盗链检查
    if (referer.startsWith(allowedReferer)) {
        chain.doFilter(request, response);
    } else {
        httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN, "Access Denied. Invalid Referer.");
    }
}

String referer = request.getHeader("Referer");

if (referer == null || referer.isEmpty()) {
    // 允许 Referer 为空的请求访问
    chain.doFilter(request, response);
} else {
    // Referer 不为空，进行正常的防盗链检查
    if (referer.startsWith(allowedReferer)) {
        chain.doFilter(request, response);
    } else {
        httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN, "Access Denied. Invalid Referer.");
    }
}

String referer = request.getHeader("Referer");

if (referer == null || referer.isEmpty()) {
    // 拒绝 Referer 为空的请求访问
    httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN, "Access Denied. Referer is missing.");
} else {
    // Referer 不为空，进行正常的防盗链检查
    if (referer.startsWith(allowedReferer)) {
        chain.doFilter(request, response);
    } else {
        httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN, "Access Denied. Invalid Referer.");
    }
}

import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.web.filter.OncePerRequestFilter;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Arrays;
import java.util.HashSet;
import java.util.Set;

public class RefererFilter extends OncePerRequestFilter {

    private final Set<String> allowedReferers = new HashSet<>();
    private final AntPathRequestMatcher requestMatcher;

    public RefererFilter(String[] allowedReferers, String path) {
        this.allowedReferers.addAll(Arrays.asList(allowedReferers));
        this.requestMatcher = new AntPathRequestMatcher(path);
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        if (!requestMatcher.matches(request)) {
            filterChain.doFilter(request, response);
            return;
        }

        String referer = request.getHeader("Referer");

        if (referer != null && allowedReferers.stream().anyMatch(referer::startsWith)) {
            filterChain.doFilter(request, response);
        } else {
            response.sendError(HttpServletResponse.SC_FORBIDDEN, "Access Denied. Invalid Referer.");
        }
    }
}

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public RefererFilter refererFilter() {
        String[] allowedReferers = {"http://www.example.com", "https://www.example.com"};
        return new RefererFilter(allowedReferers, "/protected/**"); // 对 /protected/** 下的资源进行 Referer 检查
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/public/**").permitAll() // 允许访问 /public/** 下的资源
                .anyRequest().authenticated() // 其他请求需要认证
            )
            .addFilterBefore(refererFilter(), UsernamePasswordAuthenticationFilter.class); // 在 UsernamePasswordAuthenticationFilter 之前添加 RefererFilter

        return http.build();
    }
}

allowed.referers=http://www.example.com,https://www.example.com