使用单例获取yml配置的接口List，来为过滤器设置白名单

最近在涉及登录访问接口的问题，服务器被人给攻击了，考虑给接口加白名单，如果用注解的方式还要跑到接口上去加代码也不够灵活，那么如何使用过滤器来实现呢？

让我们来用demo实现看看。

第一步、首先新建一个demo项目

jdk11

新建一个springboot项目，配置pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.example</groupId>
    <artifactId>demo</artifactId>
    <version>1.0-SNAPSHOT</version>

    <properties>
        <maven.compiler.source>11</maven.compiler.source>
        <maven.compiler.target>11</maven.compiler.target>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
            <version>2.7.7</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <version>2.7.7</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-configuration-processor</artifactId>
            <version>2.7.7</version>
        </dependency>
    </dependencies>

</project>

 新建一个启动类 DanielApplication

package com.daniel.web;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class DanielApplication {

    public static void main(String[] args) {
        SpringApplication.run(DanielApplication.class, args);
    }
}

新建一个TestController

package com.daniel.web.controller;

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/test")
public class TestController {

    @GetMapping("/hi/{name}")
    public String test(@PathVariable("name") String name) {

        return "hi~ " + name;
    }
}

测试一下接口

 

第二步、使用filter

新建DanielFilter

package com.daniel.web.filter;

import com.daniel.web.config.WhiteListConfig;

import javax.servlet.*;
import java.io.IOException;

public class DanielFilter implements Filter {

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        System.out.println("init DanielFilter");
    }

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        System.out.println("test dofilter");
        WhiteListConfig whiteListConfig = WhiteListConfig.getWhiteListConfig();

        System.out.println(whiteListConfig.getWhiteList() == null ? 0 : whiteListConfig.getWhiteList().size());
        filterChain.doFilter(servletRequest,servletResponse);
    }
}

新建Filter配置类FilterConfig

package com.daniel.web.config;

import com.daniel.web.filter.DanielFilter;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class FilterConfig {

    @Bean
    public FilterRegistrationBean<DanielFilter> registryDanielFilter() {
        FilterRegistrationBean<DanielFilter> bean = new FilterRegistrationBean<>();
        bean.setFilter(new DanielFilter());
        bean.addUrlPatterns("/*");
        bean.setOrder(1);
        return bean;
    }
}

 访问接口，日志如下

 

第三步、创建yml文件，创建单例类获取数据

新建application.yml文件

dog:
  name: Andy
  age: 3
  hobbies:
    - eat
    - play
    - swimming

uri:
  whiteList:
    - /user/
    - /name/

新建 WhiteListConfig

package com.daniel.web.config;

import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.stereotype.Component;

import java.util.List;

@Component
@ConfigurationProperties(prefix = "uri")
public class WhiteListConfig {

    private WhiteListConfig(){
        System.out.println("create WhiteListConfig");
    }

    private static final WhiteListConfig whiteListConfig = new WhiteListConfig();

    public static WhiteListConfig getWhiteListConfig(){
        return whiteListConfig;
    }

    private static List<String> whiteList;

    public List<String> getWhiteList() {
        return whiteList;
    }

    public void setWhiteList(List<String> whiteList) {
        System.out.println("use set method modify whiteList");
        WhiteListConfig.whiteList = whiteList;
    }
}

 

完成后启动springboot并访问接口，查看log

D:\dev\jdk11\bin\java.exe -agentlib:jdwp=transport=dt_socket,address=127.0.0.1:52562,suspend=y,server=n -XX:TieredStopAtLevel=1 -noverify -Dspring.output.ansi.enabled=always -javaagent:C:\Users\YIQI\AppData\Local\JetBrains\IntelliJIdea2020.3\captureAgent\debugger-agent.jar -Dcom.sun.management.jmxremote -Dspring.jmx.enabled=true -Dspring.liveBeansView.mbeanDomain -Dspring.application.admin.enabled=true -Dfile.encoding=UTF-8 -classpath "E:\javacode\demo\target\classes;C:\Users\YIQI\.m2\repository\org\springframework\boot\spring-boot-starter-web\2.7.7\spring-boot-starter-web-2.7.7.jar;C:\Users\YIQI\.m2\repository\org\springframework\boot\spring-boot-starter\2.7.7\spring-boot-starter-2.7.7.jar;C:\Users\YIQI\.m2\repository\org\springframework\boot\spring-boot\2.7.7\spring-boot-2.7.7.jar;C:\Users\YIQI\.m2\repository\org\springframework\boot\spring-boot-autoconfigure\2.7.7\spring-boot-autoconfigure-2.7.7.jar;C:\Users\YIQI\.m2\repository\org\springframework\boot\spring-boot-starter-logging\2.7.7\spring-boot-starter-logging-2.7.7.jar;C:\Users\YIQI\.m2\repository\ch\qos\logback\logback-classic\1.2.11\logback-classic-1.2.11.jar;C:\Users\YIQI\.m2\repository\ch\qos\logback\logback-core\1.2.11\logback-core-1.2.11.jar;C:\Users\YIQI\.m2\repository\org\apache\logging\log4j\log4j-to-slf4j\2.17.2\log4j-to-slf4j-2.17.2.jar;C:\Users\YIQI\.m2\repository\org\apache\logging\log4j\log4j-api\2.17.2\log4j-api-2.17.2.jar;C:\Users\YIQI\.m2\repository\org\slf4j\jul-to-slf4j\1.7.36\jul-to-slf4j-1.7.36.jar;C:\Users\YIQI\.m2\repository\jakarta\annotation\jakarta.annotation-api\1.3.5\jakarta.annotation-api-1.3.5.jar;C:\Users\YIQI\.m2\repository\org\yaml\snakeyaml\1.30\snakeyaml-1.30.jar;C:\Users\YIQI\.m2\repository\org\springframework\boot\spring-boot-starter-json\2.7.7\spring-boot-starter-json-2.7.7.jar;C:\Users\YIQI\.m2\repository\com\fasterxml\jackson\core\jackson-databind\2.13.4.2\jackson-databind-2.13.4.2.jar;C:\Users\YIQI\.m2\repository\com\fasterxml\jackson\core\jackson-annotations\2.13.4\jackson-annotations-2.13.4.jar;C:\Users\YIQI\.m2\repository\com\fasterxml\jackson\core\jackson-core\2.13.4\jackson-core-2.13.4.jar;C:\Users\YIQI\.m2\repository\com\fasterxml\jackson\datatype\jackson-datatype-jdk8\2.13.4\jackson-datatype-jdk8-2.13.4.jar;C:\Users\YIQI\.m2\repository\com\fasterxml\jackson\datatype\jackson-datatype-jsr310\2.13.4\jackson-datatype-jsr310-2.13.4.jar;C:\Users\YIQI\.m2\repository\com\fasterxml\jackson\module\jackson-module-parameter-names\2.13.4\jackson-module-parameter-names-2.13.4.jar;C:\Users\YIQI\.m2\repository\org\springframework\boot\spring-boot-starter-tomcat\2.7.7\spring-boot-starter-tomcat-2.7.7.jar;C:\Users\YIQI\.m2\repository\org\apache\tomcat\embed\tomcat-embed-core\9.0.70\tomcat-embed-core-9.0.70.jar;C:\Users\YIQI\.m2\repository\org\apache\tomcat\embed\tomcat-embed-el\9.0.70\tomcat-embed-el-9.0.70.jar;C:\Users\YIQI\.m2\repository\org\apache\tomcat\embed\tomcat-embed-websocket\9.0.70\tomcat-embed-websocket-9.0.70.jar;C:\Users\YIQI\.m2\repository\org\springframework\spring-web\5.3.24\spring-web-5.3.24.jar;C:\Users\YIQI\.m2\repository\org\springframework\spring-beans\5.3.24\spring-beans-5.3.24.jar;C:\Users\YIQI\.m2\repository\org\springframework\spring-webmvc\5.3.24\spring-webmvc-5.3.24.jar;C:\Users\YIQI\.m2\repository\org\springframework\spring-aop\5.3.24\spring-aop-5.3.24.jar;C:\Users\YIQI\.m2\repository\org\springframework\spring-context\5.3.24\spring-context-5.3.24.jar;C:\Users\YIQI\.m2\repository\org\springframework\spring-expression\5.3.24\spring-expression-5.3.24.jar;C:\Users\YIQI\.m2\repository\org\springframework\boot\spring-boot-starter-test\2.7.7\spring-boot-starter-test-2.7.7.jar;C:\Users\YIQI\.m2\repository\org\springframework\boot\spring-boot-test\2.7.7\spring-boot-test-2.7.7.jar;C:\Users\YIQI\.m2\repository\org\springframework\boot\spring-boot-test-autoconfigure\2.7.7\spring-boot-test-autoconfigure-2.7.7.jar;C:\Users\YIQI\.m2\repository\com\jayway\jsonpath\json-path\2.7.0\json-path-2.7.0.jar;C:\Users\YIQI\.m2\repository\net\minidev\json-smart\2.4.7\json-smart-2.4.7.jar;C:\Users\YIQI\.m2\repository\net\minidev\accessors-smart\2.4.7\accessors-smart-2.4.7.jar;C:\Users\YIQI\.m2\repository\org\ow2\asm\asm\9.1\asm-9.1.jar;C:\Users\YIQI\.m2\repository\org\slf4j\slf4j-api\1.7.33\slf4j-api-1.7.33.jar;C:\Users\YIQI\.m2\repository\jakarta\xml\bind\jakarta.xml.bind-api\2.3.3\jakarta.xml.bind-api-2.3.3.jar;C:\Users\YIQI\.m2\repository\jakarta\activation\jakarta.activation-api\1.2.2\jakarta.activation-api-1.2.2.jar;C:\Users\YIQI\.m2\repository\org\assertj\assertj-core\3.22.0\assertj-core-3.22.0.jar;C:\Users\YIQI\.m2\repository\org\hamcrest\hamcrest\2.2\hamcrest-2.2.jar;C:\Users\YIQI\.m2\repository\org\junit\jupiter\junit-jupiter\5.8.2\junit-jupiter-5.8.2.jar;C:\Users\YIQI\.m2\repository\org\junit\jupiter\junit-jupiter-api\5.8.2\junit-jupiter-api-5.8.2.jar;C:\Users\YIQI\.m2\repository\org\opentest4j\opentest4j\1.2.0\opentest4j-1.2.0.jar;C:\Users\YIQI\.m2\repository\org\junit\platform\junit-platform-commons\1.8.2\junit-platform-commons-1.8.2.jar;C:\Users\YIQI\.m2\repository\org\apiguardian\apiguardian-api\1.1.2\apiguardian-api-1.1.2.jar;C:\Users\YIQI\.m2\repository\org\junit\jupiter\junit-jupiter-params\5.8.2\junit-jupiter-params-5.8.2.jar;C:\Users\YIQI\.m2\repository\org\junit\jupiter\junit-jupiter-engine\5.8.2\junit-jupiter-engine-5.8.2.jar;C:\Users\YIQI\.m2\repository\org\junit\platform\junit-platform-engine\1.8.2\junit-platform-engine-1.8.2.jar;C:\Users\YIQI\.m2\repository\org\mockito\mockito-core\4.5.1\mockito-core-4.5.1.jar;C:\Users\YIQI\.m2\repository\net\bytebuddy\byte-buddy\1.12.9\byte-buddy-1.12.9.jar;C:\Users\YIQI\.m2\repository\net\bytebuddy\byte-buddy-agent\1.12.9\byte-buddy-agent-1.12.9.jar;C:\Users\YIQI\.m2\repository\org\objenesis\objenesis\3.2\objenesis-3.2.jar;C:\Users\YIQI\.m2\repository\org\mockito\mockito-junit-jupiter\4.5.1\mockito-junit-jupiter-4.5.1.jar;C:\Users\YIQI\.m2\repository\org\skyscreamer\jsonassert\1.5.1\jsonassert-1.5.1.jar;C:\Users\YIQI\.m2\repository\com\vaadin\external\google\android-json\0.0.20131108.vaadin1\android-json-0.0.20131108.vaadin1.jar;C:\Users\YIQI\.m2\repository\org\springframework\spring-core\5.3.24\spring-core-5.3.24.jar;C:\Users\YIQI\.m2\repository\org\springframework\spring-jcl\5.3.24\spring-jcl-5.3.24.jar;C:\Users\YIQI\.m2\repository\org\springframework\spring-test\5.3.24\spring-test-5.3.24.jar;C:\Users\YIQI\.m2\repository\org\xmlunit\xmlunit-core\2.9.0\xmlunit-core-2.9.0.jar;C:\Users\YIQI\.m2\repository\org\springframework\boot\spring-boot-configuration-processor\2.7.7\spring-boot-configuration-processor-2.7.7.jar;D:\dev\idea\IntelliJ IDEA 2020.3.4\lib\idea_rt.jar" com.daniel.web.DanielApplication
Connected to the target VM, address: '127.0.0.1:52562', transport: 'socket'

  .   ____          _            __ _ _
 /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
 \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
  '  |____| .__|_| |_|_| |_\__, | / / / /
 =========|_|==============|___/=/_/_/_/
 :: Spring Boot ::                (v2.7.7)

2023-06-08 10:58:17.247  INFO 9536 --- [           main] com.daniel.web.DanielApplication         : Starting DanielApplication using Java 11.0.19 on WORK-LAPTOP-02 with PID 9536 (E:\javacode\demo\target\classes started by YIQI in E:\javacode\demo)
2023-06-08 10:58:17.247  INFO 9536 --- [           main] com.daniel.web.DanielApplication         : No active profile set, falling back to 1 default profile: "default"
2023-06-08 10:58:18.554  INFO 9536 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat initialized with port(s): 8080 (http)
2023-06-08 10:58:18.570  INFO 9536 --- [           main] o.apache.catalina.core.StandardService   : Starting service [Tomcat]
2023-06-08 10:58:18.570  INFO 9536 --- [           main] org.apache.catalina.core.StandardEngine  : Starting Servlet engine: [Apache Tomcat/9.0.70]
2023-06-08 10:58:18.726  INFO 9536 --- [           main] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring embedded WebApplicationContext
2023-06-08 10:58:18.726  INFO 9536 --- [           main] w.s.c.ServletWebServerApplicationContext : Root WebApplicationContext: initialization completed in 1382 ms
init DanielFilter
create WhiteListConfig
create WhiteListConfig
use set method modify whiteList
2023-06-08 10:58:19.289  INFO 9536 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat started on port(s): 8080 (http) with context path ''
2023-06-08 10:58:19.304  INFO 9536 --- [           main] com.daniel.web.DanielApplication         : Started DanielApplication in 3.027 seconds (JVM running for 5.242)
2023-06-08 10:58:28.568  INFO 9536 --- [nio-8080-exec-1] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring DispatcherServlet 'dispatcherServlet'
2023-06-08 10:58:28.569  INFO 9536 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet'
2023-06-08 10:58:28.575  INFO 9536 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet        : Completed initialization in 4 ms
test dofilter
2

在log中可以看到，启动时执行了filter的init方法及单例的构造方法，在调用接口时，获取到了单例中用以存放接口的list，接下来就可以在Filter中取到uri跟接口的List进行比较，来实现白名单。