Tomcat中使用CSRFPreventionFilter阻止跨站请求伪造

 为解决跨站点请求伪造，在Tomcat中启用CSRFPreventionFilter，如果使用中文需要在CSRFPreventionFilter前增加中文Filter防止中文乱码。

web.xml

    captcha
    
        SimpleCaptcha
        nl.captcha.servlet.SimpleCaptchaServlet
    
    
        SimpleCaptcha
        /simpleCaptcha.jpg
    

    
        CharacterEncodingFilter
        CharaterEncodingFilter
    
    
        CharacterEncodingFilter
        /*
    

    
        CSRFPreventionFilter
        org.apache.catalina.filters.CsrfPreventionFilter
        
            entryPoints
            /index.jsp,/style.css,/chart.min.js,/bootstrap-icons-1.8.3/fonts/bootstrap-icons.woff2,/bootstrap-icons-1.8.3/fonts/bootstrap-icons.woff,/bootstrap-5.1.3-dist/css/bootstrap.min.css,/bootstrap-5.1.3-dist/js/bootstrap.bundle.min.js,/bootstrap-icons-1.8.3/bootstrap-icons.css,/jsencrypt.min.js,/simpleCaptcha.jpg
        
    

    
        CSRFPreventionFilter
        /*
    

CharaterEncodingFilter.java

import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

public class CharaterEncodingFilter implements Filter {

    public void init(FilterConfig filterConfig) throws ServletException {

    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        request.setCharacterEncoding("utf-8");
        response.setCharacterEncoding("utf-8");

        chain.doFilter(request, response);
    }

    public void destroy() {
    }
}

之后在JSP和Servlet中使用response.encodeURL()函数包裹所有连接

如POST

"
              onsubmit="encryptPassword()">

GET

">事件日志

">删除

自动刷新