如何在Java中构建图片防盗链接系统 Java判断来源并控制资源访问

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestHeader;
import org.springframework.web.bind.annotation.ResponseBody;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.InputStream;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;

@Controller
public class ImageController {

    private final String ALLOWED_DOMAIN = "http://yourdomain.com"; // 替换为你的域名

    @GetMapping("/images/{imageName:.+}") // .+: 匹配文件名，包括点
    @ResponseBody
    public void getImage(@PathVariable String imageName,
                         @RequestHeader(value = "Referer", required = false) String referer,
                         HttpServletResponse response) throws IOException {

        if (referer == null || !referer.startsWith(ALLOWED_DOMAIN)) {
            // 如果Referer为空或者不是来自允许的域名，则拒绝访问
            response.setStatus(HttpServletResponse.SC_FORBIDDEN); // 403 Forbidden
            // 可以返回一个默认的“禁止盗链”图片，或者直接结束
            return;
        }

        // 假设图片存储在某个目录下
        Path imagePath = Paths.get("/path/to/your/images/", imageName); // 替换为你的图片存储路径

        if (Files.exists(imagePath) && Files.isReadable(imagePath)) {
            response.setContentType(Files.probeContentType(imagePath));
            try (InputStream is = Files.newInputStream(imagePath)) {
                is.transferTo(response.getOutputStream());
            }
        } else {
            response.setStatus(HttpServletResponse.SC_NOT_FOUND); // 404 Not Found
        }
    }
}

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.Base64;

public class ImageTokenUtil {

    private static final String SECRET_KEY = "your_very_secret_key_here"; // 生产环境请使用更复杂的密钥
    private static final String HMAC_ALGORITHM = "HmacSHA256";
    private static final long TOKEN_EXPIRATION_MILLIS = 5 * 60 * 1000; // Token有效期：5分钟

    public static String generateSignedToken(String imagePath) {
        long expires = System.currentTimeMillis() + TOKEN_EXPIRATION_MILLIS;
        String dataToSign = imagePath + ":" + expires; // 待签名数据：图片路径 + 过期时间

        try {
            Mac mac = Mac.getInstance(HMAC_ALGORITHM);
            SecretKeySpec secretKeySpec = new SecretKeySpec(SECRET_KEY.getBytes(StandardCharsets.UTF_8), HMAC_ALGORITHM);
            mac.init(secretKeySpec);
            byte[] hmacSha256 = mac.doFinal(dataToSign.getBytes(StandardCharsets.UTF_8));
            String signature = Base64.getUrlEncoder().withoutPadding().encodeToString(hmacSha256);

            return Base64.getUrlEncoder().withoutPadding().encodeToString(dataToSign.getBytes(StandardCharsets.UTF_8)) + "." + signature;
        } catch (NoSuchAlgorithmException | InvalidKeyException e) {
            // 实际应用中需要更好的异常处理
            e.printStackTrace();
            return null;
        }
    }

    public static boolean validateSignedToken(String fullToken) {
        if (fullToken == null || !fullToken.contains(".")) {
            return false;
        }
        String[] parts = fullToken.split("\.");
        if (parts.length != 2) {
            return false;
        }

        String encodedData = parts[0];
        String receivedSignature = parts[1];

        try {
            String dataToSign = new String(Base64.getUrlDecoder().decode(encodedData), StandardCharsets.UTF_8);
            String[] dataParts = dataToSign.split(":");
            if (dataParts.length != 2) {
                return false;
            }
            String imagePath = dataParts[0];
            long expires = Long.parseLong(dataParts[1]);

            if (System.currentTimeMillis() > expires) {
                // Token已过期
                return false;
            }

            // 重新计算签名并比对
            Mac mac = Mac.getInstance(HMAC_ALGORITHM);
            SecretKeySpec secretKeySpec = new SecretKeySpec(SECRET_KEY.getBytes(StandardCharsets.UTF_8), HMAC_ALGORITHM);
            mac.init(secretKeySpec);
            byte[] hmacSha256 = mac.doFinal(dataToSign.getBytes(StandardCharsets.UTF_8));
            String expectedSignature = Base64.getUrlEncoder().withoutPadding().encodeToString(hmacSha256);

            return expectedSignature.equals(receivedSignature);

        } catch (Exception e) {
            // 签名解析或验证失败
            e.printStackTrace();
            return false;
        }
    }
}

// 假设ImageController中引入了ImageTokenUtil
// ... 其他导入和类定义 ...

@GetMapping("/secure-images/{encodedToken}/{imageName:.+}")
@ResponseBody
public void getSecureImage(@PathVariable String encodedToken,
                           @PathVariable String imageName,
                           HttpServletResponse response) throws IOException {

    // 实际的图片路径需要从token中解析出来，或者这里只作为辅助验证
    // 假设token中包含完整的图片路径信息，这里简化处理
    String fullToken = encodedToken + "." + imageName; // 这里需要根据实际token生成方式调整

    if (!ImageTokenUtil.validateSignedToken(fullToken)) {
        response.setStatus(HttpServletResponse.SC_FORBIDDEN); // 403 Forbidden
        return;
    }

    // 从token中解析出实际的图片路径，或者直接使用imageName（如果token只负责验证权限）
    // 为了简化，这里仍然假设imageName是实际的文件名，但实际应用中，token应包含完整路径或校验路径
    Path imagePath = Paths.get("/path/to/your/images/", imageName);

    if (Files.exists(imagePath) && Files.isReadable(imagePath)) {
        response.setContentType(Files.probeContentType(imagePath));
        try (InputStream is = Files.newInputStream(imagePath)) {
            is.transferTo(response.getOutputStream());
        }
    } else {
        response.setStatus(HttpServletResponse.SC_NOT_FOUND); // 404 Not Found
    }
}

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.ResponseBody;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.InputStream;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;

@Controller
public class SecureImageController {

    private final String IMAGE_BASE_PATH = "/path/to/your/images/"; // 你的图片存储根目录

    @GetMapping("/secure-images/{imageName:.+}") // 这里的URL不再包含token，token会在拦截器中处理
    @ResponseBody
    public void getSecureImage(@PathVariable String imageName,
                               HttpServletResponse response) throws IOException {
        // 假设拦截器已经验证了权限，这里直接提供图片
        Path imagePath = Paths.get(IMAGE_BASE_PATH, imageName);

        if (Files.exists(imagePath) && Files.isReadable(imagePath)) {
            response.setContentType(Files.probeContentType(imagePath));
            try (InputStream is = Files.newInputStream(imagePath)) {
                is.transferTo(response.getOutputStream());
            }
        } else {
            response.setStatus(HttpServletResponse.SC_NOT_FOUND); // 图片不存在
        }
    }
}

import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.net.URLDecoder;
import java.nio.charset.StandardCharsets;

public class AntiHotlinkInterceptor implements HandlerInterceptor {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        // 从请求参数中获取token，例如：/secure-images/pic.jpg?token=XYZ
        String token = request.getParameter("token");
        String requestUri = request.getRequestURI(); // /secure-images/pic.jpg
        String imageName = requestUri.substring(requestUri.lastIndexOf('/') + 1); // pic.jpg

        // 假设token中需要包含imageName作为验证的一部分
        // 实际场景中，token可能只包含一个资源ID，然后通过ID去查找资源路径
        String dataToValidate = imageName; // 或者更复杂的，从token中解析出原始数据

        if (token == null || !ImageTokenUtil.validateSignedToken(token)) {
            // Token无效或缺失
            response.setStatus(HttpServletResponse.SC_FORBIDDEN); // 403 Forbidden
            // 可以选择返回一个默认的“禁止盗链”图片，或者一个错误页面
            // response.sendRedirect("/error-images/hotlink-forbidden.png");
            return false; // 阻止请求继续向下执行
        }

        // 如果token验证通过，则放行
        return true;
    }

    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
        // 在Controller方法执行后，视图渲染前执行
    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
        // 在整个请求完成后执行，用于资源清理等
    }
}