使用filter验证session用户和页面缓存问题处理

WEB的信息安全隐患之一:

未授权用户通过直接在IE中输入URL直接登录系统

解决办法:

通过配置filter过滤无效用户的连接请求.

WEB的信息安全隐患之二:

合法用户"注销"后,在未关闭浏览器的情况下,点击浏览器"后退"按钮,可从与本地页面缓存中读取数据,绕过了服务端filter过滤.

解决办法:

在必要的页面(包含敏感信息) 设定页面缓存限制.

也可以把上面两步组合在一个,通过同一个filter实现.具体如下:

1.配置filter(web.xml)

......


Authentication
com.mycompany.myweb.management.util.AuthenticationFilter

onError
/Logon.do



Authentication
/management/*


Authentication
/Main.do


......

AuthenticationFilter过滤器实现类:

package com.mycompany.myweb.management.util;

import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.*;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import org.apache.struts.Globals;
import org.apache.struts.action.*;

public class AuthenticationFilter implements Filter {//一定要使用Filter接口
private FilterConfig filterConfig;

private String onErrorUrl;

public void init(FilterConfig config) throws ServletException {
filterConfig = config;
onErrorUrl = filterConfig.getInitParameter("onError");
if (onErrorUrl == null || "".equals(onErrorUrl)) {
onErrorUrl = "onError";
}
}

public void doFilter(ServletRequest request, ServletResponse response,
FilterChain next) throws IOException, ServletException {
HttpServletRequest httpRequest = (HttpServletRequest) request;
HttpServletResponse httpResponse = (HttpServletResponse) response;
HttpSession httpSession = httpRequest.getSession();
/**
* @author justin ray
* @see 页面缓存设定
*
确保浏览器不缓存页面数据
*/

httpResponse.setHeader("Cache-Control","no-cache");
httpResponse.setHeader("Cache-Control","no-store");
httpResponse.setDateHeader("Expires", 0);
httpResponse.setHeader("Pragma","no-cache");

/**
* @author justin ray
* @see 过滤未登录用户无效请求
*
未登录用户请求跳转到/Logon.do
*/
if (httpSession.getAttribute("ePAccountInfo") == null) {
ActionErrors errors = new ActionErrors();
errors.add(ActionMessages.GLOBAL_MESSAGE, new ActionMessage("没有登录"));
httpRequest.setAttribute(Globals.ERROR_KEY, errors);
httpRequest.getRequestDispatcher(onErrorUrl).forward(httpRequest,
httpResponse);
} else
next.doFilter(request, response);
}

public void destroy() {
}

}



其他方式,如:在一个JSP里实现用户登录验证,其他JSP页面通过include引入验证