Hello,I’m Shendi
当我的接口遭到恶意访问时,我想返回404,达到让其以为此接口不存在的目的
实现思路
因为使用的 SpringBoot,所以第一时间想搜寻是否提供了某种方法来让我实现,然并卵
后来想到使用过滤器,过滤器可以在接口执行完毕后继续执行一些操作
因我要获取接口是否响应了数据,所以需要代理响应
允许扫描Servlet注解
因使用的SpringBoot,要扫描Servlet注解需要在启动类(Application)上加上 @ServletComponentScan注解
@ServletComponentScan
public class Application {}
编写过滤器
/**
* 默认过滤器,统一编码,以及响应体为null则返回404错误.
* @author Shendi <a href='tencent://AddContact/?fromId=45&fromSubId=1&subcmd=all&uin=1711680493'>QQ</a>
* @version 1.0
*/
@WebFilter("/*")
public class DefaultFilter extends HttpFilter {
private static final long serialVersionUID = 3455876099526058476L;
public static final String ENCODING = "UTF-8";
@Override
protected void doFilter(HttpServletRequest req, HttpServletResponse resp, FilterChain chain) throws IOException, ServletException {
req.setCharacterEncoding(ENCODING);
resp.setCharacterEncoding(ENCODING);
// 代理响应
MyResponse mr = new MyResponse(resp);
chain.doFilter(req, mr);
if (mr.nullResp) resp.setStatus(404);
}
class MyResponse extends HttpServletResponseWrapper {
/** 响应是否为空 */
public boolean nullResp = true;
public MyResponse(HttpServletResponse response) {
super(response);
}
@Override
public ServletOutputStream getOutputStream() throws IOException {
// 当接口return null或者无返回值时,则不会触发此函数
nullResp = false;
return super.getOutputStream();
}
}
}
后续补充
大意了,当项目前后端分离,跨域请求,有时浏览器会自行的发送一个options请求,如果不响应200状态,浏览器则会报错
Access to XMLHttpRequest at 'xxx' from origin 'xxx' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status.
因为是浏览器自行发起的请求,所以与我们写的无关,在过滤器中判断是否为 options 请求,是则直接放行即可
/**
* 默认过滤器,统一编码,以及响应体为null则返回404错误.
* @author Shendi <a href='tencent://AddContact/?fromId=45&fromSubId=1&subcmd=all&uin=1711680493'>QQ</a>
* @version 1.0
*/
@WebFilter("/*")
public class DefaultFilter extends HttpFilter {
private static final long serialVersionUID = 3455876099526058476L;
public static final String ENCODING = "UTF-8";
@Override
protected void doFilter(HttpServletRequest req, HttpServletResponse resp, FilterChain chain) throws IOException, ServletException {
req.setCharacterEncoding(ENCODING);
resp.setCharacterEncoding(ENCODING);
// 如果是 option 请求则直接放行
if ("OPTIONS".equals(req.getMethod())) {
chain.doFilter(req, resp);
return;
}
// 代理响应
MyResponse mr = new MyResponse(resp);
chain.doFilter(req, mr);
if (mr.nullResp) resp.setStatus(404);
}
class MyResponse extends HttpServletResponseWrapper {
/** 响应是否为空 */
public boolean nullResp = true;
public MyResponse(HttpServletResponse response) {
super(response);
}
@Override
public ServletOutputStream getOutputStream() throws IOException {
// 当接口return null或者无返回值时,则不会触发此函数
nullResp = false;
return super.getOutputStream();
}
}
}