提交配置校验

base-manager/src/main/java/com/mortals/xhx/base/framework/filter/SameSiteCookieFilter.java

 package com.mortals.xhx.base.framework.filter;
 
+import cn.hutool.core.util.StrUtil;
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.context.annotation.ComponentScan;
-import org.springframework.http.ResponseCookie;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
+import org.springframework.context.annotation.Profile;
 import org.springframework.stereotype.Component;
+import org.springframework.util.ObjectUtils;
 
 import javax.servlet.*;
 import javax.servlet.http.*;
 import java.io.IOException;
+import java.util.List;
 
 @Slf4j
 @Component
+@Profile({"yanyuan", "test"})
 public class SameSiteCookieFilter implements Filter {
+
+    /**
+     * cookie的密钥
+     */
+    @Value("${trustedReferer:''}")
+    private String trustedReferer;
+
     @Override
     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
             throws IOException, ServletException {
         HttpServletResponse httpResponse = (HttpServletResponse) response;
+        HttpServletRequest httpRequest = (HttpServletRequest) request;
         Cookie[] cookies = ((HttpServletRequest) request).getCookies();
         if (cookies != null) {
             for (Cookie cookie : cookies) {
@@ -26,7 +39,18 @@ public class SameSiteCookieFilter implements Filter {
                 httpResponse.addCookie(cookie);
             }
         }
+        //cors
+        String referer = httpRequest.getHeader("Referer");
+        if(ObjectUtils.isEmpty(referer))  chain.doFilter(request, response);
 
+        List<String> trustReferers = StrUtil.split(trustedReferer, ",");
+        if(ObjectUtils.isEmpty(trustReferers))  chain.doFilter(request, response);
+
+        if(trustReferers.contains(referer)) {
+            chain.doFilter(request, response);
+        }else {
+            httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN, "CSRF protection");
+        }
         chain.doFilter(request, response);
     }
 

base-manager/src/main/resources/bootstrap.yml

@@ -48,4 +48,5 @@ application:
     uncheckUrl: /refresh,/error,/login/login,/login/index,/login/logout,/securitycode/createCode,/file/common/*,/test*,/padsign/*,/terminal/*,/resource/list,/api/asset/*,/api/*,/flow/*,/uploads/*,/project/file/*,/file/*,/assessment/*
 dm:
   enable: true
-jsonCheck: @profiles.req.json.check@
\ No newline at end of file
+jsonCheck: @profiles.req.json.check@
+trustedReferer : http://192.168.0.98:11072/,http://192.168.0.98:11072
\ No newline at end of file