Spring MVC和Jetty：防止jsessionid在RedirectView中用于重定向到外部站点

1 回答

• 2

  现在这里是我在上面的评论中计划的ExternalRedirectView ......就这样做了 .

  import java.io.IOException;
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  import org.springframework.web.servlet.view.RedirectView;
  
  /** variant of RedirectView, will not add a session id to the url
   */
  public class ExternalRedirectView extends RedirectView {
      public ExternalRedirectView(String url, boolean contextRelative) {
          super(url, contextRelative);
      }
  
      /** copied from @link{RedirectView#sendRedirect} and removed calls to
       * reponse.encodeRedirectURL()
       */
      @Override
      protected void sendRedirect( HttpServletRequest request,
              HttpServletResponse response, String targetUrl,
              boolean http10Compatible ) throws IOException {
          if (http10Compatible) {
              // Always send status code 302.
              response.sendRedirect(targetUrl);
          }
          else {
              // Correct HTTP status code is 303, in particular for POST requests.
              response.setStatus(303);
              response.setHeader("Location", targetUrl);
          }
      }
  }
  

  我也已经有了自己的ViewResolver，我在其中添加了新的externalRedirect：magic vier名称前缀的功能，现在读取：

  class MyViewResolver extends AbstractCachingViewResolver implements BeanFactoryAware {
  [...]
      private static final String EXTERNAL_REDIRECT_URL_PREFIX = "externalRedirect:";
  [...]
      @Override
      protected View loadView( String viewName, Locale locale ) throws Exception {
          View view;
          if (viewName.startsWith(UrlBasedViewResolver.REDIRECT_URL_PREFIX)) 
          {
              view = new RedirectView(viewName.substring(UrlBasedViewResolver.REDIRECT_URL_PREFIX.length()), true);
          }
          else if (viewName.startsWith(EXTERNAL_REDIRECT_URL_PREFIX)) 
          {
              view = new ExternalRedirectView(viewName.substring(EXTERNAL_REDIRECT_URL_PREFIX.length()), true);
          }
          else
  

  [...]感谢所有阅读此内容并思考它的人 .

  回复于 2024-04-29T05:00:53+08:00