基於SpringSecutrity實現黑白名單請求過濾

編寫filter

package com.dstz.security.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

import org.apache.commons.lang3.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import com.dstz.base.rest.util.IPUtils;
import com.dstz.security.IngoreChecker;

/**
 * 白名單過濾器
 * 白名單IP在 -> app-security.xml 配置
 */
public class WhiteIpFilter extends IngoreChecker implements Filter {

	protected Logger logger = LoggerFactory.getLogger(this.getClass());

    @Override
    public void destroy() {
    	
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        String path = req.getServletPath();
        if(!path.contains("/btw")) {  // 如果不是請求的對外接口，忽略
        	 chain.doFilter(request, response);
        }else {
        	  logger.debug("----- 驗證該IP是否是白名單 - 開始 -------");
              // 獲取ip地址
              String realIP = IPUtils.getRealIP(req);
              if(StringUtils.isNotBlank(realIP)) {
              	boolean isIngoreUrl = this.isIngores(realIP);
              	if (isIngoreUrl) {
              		logger.debug("該IP是白名單！");
                    chain.doFilter(request, response);
                } else {
                	logger.debug("該IP不存在白名單中！拒絕訪問！");
                     response.getWriter().print("你沒有操作該api的操作權限");
                }
              }else {
              	// 無法獲取到ip
              	response.getWriter().print("沒有獲取到請求的ip地址");
              }
        }
      
    }
    
    @Override
    public void init(FilterConfig config) throws ServletException {
    }

}

工具類

package com.dstz.base.rest.util;

import javax.servlet.http.HttpServletRequest;

public class IPUtils {
    /**
     * 獲取用戶真實IP地址，不使用request.getRemoteAddr()的原因是有可能用戶使用了代理軟件方式避免真實IP地址,
     * 可是，如果通過了多級反向代理的話，X-Forwarded-For的值並不止一個，而是一串IP值
     *
     * @return ip
     */
    public static String getRealIP(HttpServletRequest request) {
        String ip = request.getHeader("x-forwarded-for");
        if (ip != null && ip.length() != 0 && !"unknown".equalsIgnoreCase(ip)) {
            // 多次反向代理後會有多個ip值，第一個ip纔是真實ip
            if( ip.indexOf(",")!=-1 ){
                ip = ip.split(",")[0];
            }
        }
        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("Proxy-Client-IP");
//            System.out.println("Proxy-Client-IP ip: " + ip);
        }
        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("WL-Proxy-Client-IP");
//            System.out.println("WL-Proxy-Client-IP ip: " + ip);
        }
        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("HTTP_CLIENT_IP");
//            System.out.println("HTTP_CLIENT_IP ip: " + ip);
        }
        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("HTTP_X_FORWARDED_FOR");
//            System.out.println("HTTP_X_FORWARDED_FOR ip: " + ip);
        }
        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("X-Real-IP");
//            System.out.println("X-Real-IP ip: " + ip);
        }
        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getRemoteAddr();
//            System.out.println("getRemoteAddr ip: " + ip);
        }
        return ip;
    }
}

配置文件

<!-- security 版本 -->
    <security:http entry-point-ref="authenticationLoginEntry">
        <security:remember-me key="rememberPrivateKey"/>




		<!-- 核心 -->
        <security:custom-filter ref="whiteIpFilter" before="CAS_FILTER"/>

        

        <security:custom-filter before="FILTER_SECURITY_INTERCEPTOR" ref="securityInterceptor"/>
        <security:access-denied-handler ref="accessDeniedHandler"/>
        <security:headers>
			<security:frame-options policy="SAMEORIGIN"/>
		</security:headers>
        <security:csrf disabled="true"/>
    </security:http>
<!-- 白名單過濾，下方list爲

允許訪問的接口的ip地址 -->
    <bean id="whiteIpFilter" class="com.dstz.security.filter.WhiteIpFilter">
     	<property name="ingores">
            <list>
            	 <value>192.168.31.164</value>
                 <value>127.0.0.1</value>
                 <value>localhost</value>
                 <value>47.106.139.29</value>
            </list>
         </property>
    </bean>