在页面中添加Token防止越权访问

来源：互联网发布：中信信托知乎编辑：程序博客网时间：2024/05/16 14:03

1、首先是在访问JSP的时候生成一个随机数，放入session中。同时会在服务器缓存一份Token。

2、当form到后台后，调用工具类验证Token。会在TokenList中验证是有该Token值，如果有则验证通过，同时删除List中的Token。

1.引入工具类

package com.yiwei.utils;import java.util.ArrayList;import javax.servlet.http.HttpSession;public class Token {private static final String TOKEN_LIST_NAME = "tokenList";public static final String TOKEN_STRING_NAME = "token";private static ArrayList getTokenList(HttpSession session) {Object obj = session.getAttribute(TOKEN_LIST_NAME);if (obj != null) {return (ArrayList) obj;} else {ArrayList tokenList = new ArrayList();session.setAttribute(TOKEN_LIST_NAME, tokenList);return tokenList;}}private static void saveTokenString(String tokenStr, HttpSession session) {ArrayList tokenList = getTokenList(session);tokenList.add(tokenStr);session.setAttribute(TOKEN_LIST_NAME, tokenList);}private static String generateTokenString() {return new Long(System.currentTimeMillis()).toString();}/** *//** *  * Generate a token string, and save the string in session, then return the * token string. *  *  *  * @param HttpSession *  *            session *  * @return a token string used for enforcing a single request for a *         particular transaction. *  */public static String getTokenString(HttpSession session) {String tokenStr = generateTokenString();saveTokenString(tokenStr, session);return tokenStr;}/** *//** *  * check whether token string is valid. if session contains the token * string, return true. *  * otherwise, return false. *  *  *  * @param String *  *            tokenStr *  * @param HttpSession *  *            session *  * @return true: session contains tokenStr; false: session is null or *         tokenStr is id not in session *  */public static boolean isTokenStringValid(String tokenStr, HttpSession session) {boolean valid = false;if (session != null) {ArrayList tokenList = getTokenList(session);if (tokenList.contains(tokenStr)) {valid = true;tokenList.remove(tokenStr);}}return valid;}}

2.在JSP页面导入类包

<%@ page import="com.yiwei.utils.Token" %>

3.在JSP页面form表单添加隐藏域

<input type="hidden" name="<%=Token.TOKEN_STRING_NAME %>" value="<%=Token.getTokenString(session) %>">

4.后台验证Token

if(!Token.isTokenStringValid(request.getParameter(Token.TOKEN_STRING_NAME), request.getSession())){responseMessage(response, "非法访问");return;}

1 0