通过HttpServletResponseWrapper修改response输出流
在项目中遇到一个问题，需要对接口返回的数据进行加密给前端。项目中的controller一般都是返回一个实体form，重写的一个视图解析器继承ModelAndViewResolver，对返回的form转成json格式返回给前端。
视图解析器：
public class JsonModelAndViewResolver implements ModelAndViewResolver,
InitializingBean, ApplicationContextAware {
private String defaultContentType = "text/html";
private Log log = LogFactory.getLog(super.getClass());
private JsonSerialization jsonSerialization;
private ApplicationContext applicationContext;
public void afterPropertiesSet() throws Exception {
if (this.jsonSerialization != null)
return;
this.jsonSerialization = JsonSerializationFactory.getInstance(this.applicationContext);
}
public void setApplicationContext(ApplicationContext paramApplicationContext)
throws BeansException {
this.applicationContext = paramApplicationContext;
}
//执行这个方法
public ModelAndView resolveModelAndView(Method paramMethod,
Class paramClass, Object paramObject,
ExtendedModelMap paramExtendedModelMap,
NativeWebRequest paramNativeWebRequest) {
if (Rest.class.isAssignableFrom(paramClass)) {
try {
HttpServletResponse localHttpServletResponse = (HttpServletResponse) paramNativeWebRequest.getNativeResponse(HttpServletResponse.class);
responseJson(paramObject, localHttpServletResponse);
} catch (IOException localIOException) {
throw new WebException(localIOException.getMessage(),
localIOException);
}
return null;
}
return UNRESOLVED;
}
public void responseJson(Object paramObject,
HttpServletResponse paramHttpServletResponse) throws IOException {
if (!(StringUtils.hasText(paramHttpServletResponse.getContentType())))
paramHttpServletResponse.setContentType(this.defaultContentType);
String str = writeResult(paramObject);
PrintWriter localPrintWriter = paramHttpServletResponse.getWriter();
if (this.log.isInfoEnabled())
this.log.info("Rest result=" + str);
if ("{}".equals(str)) {
this.log.info("image stream is not write ");
return;
}
localPrintWriter.write(str);
localPrintWriter.flush();
}
protected String writeResult(Object paramObject) {
String str = null;
if (paramObject == null) {
str = "{}";
} else if ((paramObject instanceof Number)
|| (paramObject instanceof Boolean)) {
str = "{\"resultCode\":\"" + paramObject.toString() + "\"}";
} else if ((paramObject instanceof String)) {
String result = (String) paramObject;
str = result;
} else {
if (paramObject instanceof ModelAndView)
paramObject = ((ModelAndView) paramObject).getModel();
str = getJsonSerialization().toJSONString(paramObject);
}
return str;
}
public String getDefaultContentType() {
return this.defaultContentType;
}
public void setDefaultContentType(String paramString) {
this.defaultContentType = paramString;
}
public JsonSerialization getJsonSerialization() {
return this.jsonSerialization;
}
public void setJsonSerialization(JsonSerialization paramJsonSerialization) {
this.jsonSerialization = paramJsonSerialization;
}
}
本来考虑直接修改视图解析器，对返回json串加密，但发现项目中有些接口直接在controller中直接通过PrintWriter返回了参数，显然有这种方法是拦截不到的。
最后通过HttpServletResponseWrapper截取返回数据流加密重新输出给前端的方式。
代码参照如下：
ResponseWrapper:
package com.paic.egis.smts.toa.web.interceptor;
import java.io.CharArrayWriter;
import java.io.IOException;
import java.io.PrintWriter;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpServletResponseWrapper;
import com.paic.egis.smts.common.util.LoggerUtil;
public class ResponseWrapper extends HttpServletResponseWrapper {
private PrintWriter cachedWriter;
private CharArrayWriter bufferedWriter;
public ResponseWrapper(HttpServletResponse response) throws IOException {
super(response);
bufferedWriter = new CharArrayWriter();
cachedWriter = new PrintWriter(bufferedWriter);
}
public PrintWriter getWriter() throws IOException {
return cachedWriter;
}
public String getResult() {
byte[] bytes = bufferedWriter.toString().getBytes();
try {
return new String(bytes, "UTF-8");
} catch (Exception e) {
LoggerUtil.logError(this.getClass().getName(), "getResult", e);
return "";
}
}
}
过滤器如下：
package com.paic.egis.smts.toa.web.filter;
import java.io.IOException;
import java.io.PrintWriter;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletResponse;
import com.alibaba.dubbo.common.utils.StringUtils;
import com.paic.egis.smts.common.util.LoggerUtil;
import com.paic.egis.smts.common.util.PropertiesUtil;
import com.paic.egis.smts.pama.security.Base64Utils;
import com.paic.egis.smts.toa.web.interceptor.ResponseWrapper;
import com.paic.egis.smts.trusteesship.util.RSACoder;
public class ResponseWrapperFilter implements Filter {
public void destroy() {
}
public void doFilter(ServletRequest req, ServletResponse resp,
FilterChain chain) throws IOException, ServletException {
String version = req.getParameter("version");
if(StringUtils.isEmpty(version)){
chain.doFilter(req, resp);
} else {
HttpServletResponse response = (HttpServletResponse) resp;
ResponseWrapper mr = new ResponseWrapper(response);
chain.doFilter(req, mr);
PrintWriter out = resp.getWriter();
try {
//取返回的json串
String result = mr.getResult();
System.out.println(result);
//加密
String encryptStr = encryptRSA(result);
out.write(encryptStr);
} catch (Exception e) {
LoggerUtil.logError(this.getClass().getName(), "doFilter", e);
} finally {
out.flush();
out.close();
}
}
}
@Override
public void init(FilterConfig filterconfig) throws ServletException {
}
//rsa公钥加密
public String encryptRSA(String content) throws Exception{
String publicKeyStr = PropertiesUtil.getProperty("response.publicKey");
byte[] encryptBytes = RSACoder.encrypt(content.getBytes("utf-8"), publicKeyStr,"public");
return Base64Utils.encode(encryptBytes);
}
}
在测试阶段发现，有的接口会出现重复加密的问题。
过滤器配置如下:
<filter> <filter-name>encryptFilter</filter-name> <filter-class>com.paic.egis.smts.toa.web.filter.ResponseWrapperFilter</filter-class> </filter> <filter-mapping> <filter-name>encryptFilter</filter-name> <url-pattern>*.do</url-pattern> </filter-mapping> <filter-mapping> <filter-name>encryptFilter</filter-name> <url-pattern>/do/*</url-pattern> </filter-mapping> <filter-mapping> <filter-name>encryptFilter</filter-name> <url-pattern>/doh/*</url-pattern> </filter-mapping> <filter-mapping> <filter-name>encryptFilter</filter-name> <url-pattern>*.doh</url-pattern> </filter-mapping> <filter-mapping> <filter-name>encryptFilter</filter-name> <url-pattern>/app/*</url-pattern> </filter-mapping> <filter-mapping> <filter-name>encryptFilter</filter-name> <url-pattern>/mamc/*</url-pattern> </filter-mapping>
当接口地址是类似/do/smi/queryRegionInfo.do，过滤器类中会进入两次，对应同一个response，所以在第一次out.write(encryptStr); 时，就更改了response的输出值，在第二次String result = mr.getResult(); 时取得就是第一次加密后的值。
将接口改为/smi/queryRegionInfo.do就不会出现这种情况。
