websocket增加token校验，解决安全问题

zhangdaiscott
1 parent 2be6e884
Showing 3 changed files with 102 additions and 0 deletions
jeecg-boot/jeecg-boot-base/jeecg-boot-base-core/src/main/java/org/jeecg/config/WebSocketConfig.java
jeecg-boot/jeecg-boot-base/jeecg-boot-base-core/src/main/java/org/jeecg/config/filter/RequestBodyReserveFilter.java
jeecg-boot/jeecg-boot-base/jeecg-boot-base-core/src/main/java/org/jeecg/config/filter/WebsocketFilter.java
 package org.jeecg.config;
  
+import org.jeecg.config.filter.WebsocketFilter;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.socket.server.standard.ServerEndpointExporter;
@@ -19,4 +21,17 @@ public class WebSocketConfig {
         return new ServerEndpointExporter();
     }
  
+    @Bean
+    public WebsocketFilter websocketFilter(){
+        return new WebsocketFilter();
+    }
+
+    @Bean
+    public FilterRegistrationBean getFilterRegistrationBean(){
+        FilterRegistrationBean bean = new FilterRegistrationBean();
+        bean.setFilter(websocketFilter());
+        bean.addUrlPatterns("/websocket/*", "/eoaSocket/*", "/newsWebsocket/*", "/vxeSocket/*");
+        return bean;
+    }
+
 }
+package org.jeecg.config.filter;
+
+import org.jeecg.common.constant.CommonConstant;
+import org.jeecg.config.sign.util.BodyReaderHttpServletRequestWrapper;
+
+import javax.servlet.*;
+import javax.servlet.http.HttpServletRequest;
+import java.io.IOException;
+
+/**
+ * 针对post请求，将HttpServletRequest包一层 保留body里的参数
+ * @Author taoYan
+ * @Date 2022/4/25 19:19
+ **/
+public class RequestBodyReserveFilter implements Filter {
+
+    @Override
+    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
+        ServletRequest requestWrapper = null;
+
+        if(servletRequest instanceof HttpServletRequest) {
+            HttpServletRequest req = (HttpServletRequest) servletRequest;
+            // POST请求类型，才获取POST请求体
+            if(CommonConstant.HTTP_POST.equals(req.getMethod())){
+                requestWrapper = new BodyReaderHttpServletRequestWrapper(req);
+            }
+        }
+
+        if(requestWrapper == null) {
+            filterChain.doFilter(servletRequest, servletResponse);
+        } else {
+            filterChain.doFilter(requestWrapper, servletResponse);
+        }
+    }
+}
+package org.jeecg.config.filter;
+
+import lombok.extern.slf4j.Slf4j;
+import org.jeecg.common.api.CommonAPI;
+import org.jeecg.common.util.RedisUtil;
+import org.jeecg.common.util.SpringContextUtils;
+import org.jeecg.common.util.TokenUtils;
+
+import javax.servlet.*;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * websocket 前端将token放到子协议里传入 与后端建立连接时需要用到http协议，此处用于校验token的有效性
+ * @Author taoYan
+ * @Date 2022/4/21 17:01
+ **/
+@Slf4j
+public class WebsocketFilter implements Filter {
+
+    private static final String TOKEN_KEY = "Sec-WebSocket-Protocol";
+
+    private static CommonAPI commonApi;
+
+    private static RedisUtil redisUtil;
+
+    @Override
+    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
+        if (commonApi == null) {
+            commonApi = SpringContextUtils.getBean(CommonAPI.class);
+        }
+        if (redisUtil == null) {
+            redisUtil = SpringContextUtils.getBean(RedisUtil.class);
+        }
+        HttpServletRequest request = (HttpServletRequest)servletRequest;
+        String token = request.getHeader(TOKEN_KEY);
+
+        log.info("websocket连接 Token安全校验，Path = {}，token:{}", request.getRequestURI(), token);
+
+        try {
+            TokenUtils.verifyToken(token, commonApi, redisUtil);
+        } catch (Exception exception) {
+            log.error("websocket连接校验失败，{}，token:{}", exception.getMessage(), token);
+            return;
+        }
+        HttpServletResponse response = (HttpServletResponse)servletResponse;
+        response.setHeader(TOKEN_KEY, token);
+        filterChain.doFilter(servletRequest, servletResponse);
+    }
+
+}