org.tinygroup.weblayer.webcontext.basic.interceptor

Class ResponseHeaderSecurityFilter

java.lang.Object

org.tinygroup.weblayer.webcontext.basic.interceptor.ResponseHeaderSecurityFilter

All Implemented Interfaces:

CookieHeaderValueInterceptor, CookieInterceptor, HeaderNameInterceptor, HeaderValueInterceptor, RedirectLocationInterceptor, ResponseHeaderInterceptor, StatusMessageInterceptor, WebContextLifecycleInterceptor

public class ResponseHeaderSecurityFilter
extends Object
implements WebContextLifecycleInterceptor, HeaderNameInterceptor, HeaderValueInterceptor, CookieInterceptor, CookieHeaderValueInterceptor, StatusMessageInterceptor, RedirectLocationInterceptor

过滤header中的crlf，将status message用HTML entities转义，限制cookie的总大小。

Author:

renhui

Field Summary

Fields

Modifier and Type	Field and Description
static HumanReadableSize	MAX_SET_COOKIE_SIZE_DEFAULT

Constructor Summary

Constructors

Constructor and Description
ResponseHeaderSecurityFilter()
ResponseHeaderSecurityFilter(javax.servlet.http.HttpServletRequest request)

Method Summary

Modifier and Type	Method and Description
javax.servlet.http.Cookie	checkCookie(javax.servlet.http.Cookie cookie) 检查cookie。
String	checkCookieHeaderValue(String name, String value, boolean setHeader) 检查cookie header。
String	checkHeaderName(String name) 检查header名称。
String	checkHeaderValue(String name, String value) 检查header的值。
String	checkRedirectLocation(String location) 检查重定向location。
String	checkStatusMessage(int sc, String msg) 检查status消息。
void	commit()
void	commitHeaders()
HumanReadableSize	getMaxCookieSize()
void	prepare()
void	setMaxCookieSize(HumanReadableSize maxSetCookieSize)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

MAX_SET_COOKIE_SIZE_DEFAULT

public static final HumanReadableSize MAX_SET_COOKIE_SIZE_DEFAULT

Constructor Detail

ResponseHeaderSecurityFilter

public ResponseHeaderSecurityFilter()

ResponseHeaderSecurityFilter

public ResponseHeaderSecurityFilter(javax.servlet.http.HttpServletRequest request)

Method Detail

getMaxCookieSize

public HumanReadableSize getMaxCookieSize()

setMaxCookieSize

public void setMaxCookieSize(HumanReadableSize maxSetCookieSize)

prepare

public void prepare()

Specified by:

prepare in interface WebContextLifecycleInterceptor

commitHeaders

public void commitHeaders()

Specified by:

commitHeaders in interface WebContextLifecycleInterceptor

commit

public void commit()

Specified by:

commit in interface WebContextLifecycleInterceptor

checkHeaderName

public String checkHeaderName(String name)

Description copied from interface: HeaderNameInterceptor

检查header名称。

Specified by:

checkHeaderName in interface HeaderNameInterceptor

Returns:

返回值表示修改header的名称，返回null则丢弃header。

checkHeaderValue

public String checkHeaderValue(String name,
                               String value)

Description copied from interface: HeaderValueInterceptor

检查header的值。

Specified by:

checkHeaderValue in interface HeaderValueInterceptor

Returns:

返回值表示修改header的值，返回null则表示拒绝该header的值。

checkCookie

public javax.servlet.http.Cookie checkCookie(javax.servlet.http.Cookie cookie)

Description copied from interface: CookieInterceptor

检查cookie。

Specified by:

checkCookie in interface CookieInterceptor

Returns:

返回值表示修改cookie，返回null则表示拒绝该cookie。 特别支持 CookieSupport类。

checkCookieHeaderValue

public String checkCookieHeaderValue(String name,
                                     String value,
                                     boolean setHeader)

Description copied from interface: CookieHeaderValueInterceptor

检查cookie header。

Specified by:

checkCookieHeaderValue in interface CookieHeaderValueInterceptor

Returns:

返回值表示修改header的值，返回null则表示拒绝该cookie。

checkStatusMessage

public String checkStatusMessage(int sc,
                                 String msg)

Description copied from interface: StatusMessageInterceptor

检查status消息。

Specified by:

checkStatusMessage in interface StatusMessageInterceptor

Returns:

返回值表示修改status消息，返回null则表示不设置status消息。

checkRedirectLocation

public String checkRedirectLocation(String location)

Description copied from interface: RedirectLocationInterceptor

检查重定向location。

Specified by:

checkRedirectLocation in interface RedirectLocationInterceptor

Returns:

返回值表示修改location，返回null则表示拒绝该location。