校验Referer头，防范CSRF(跨站请求伪造)攻击的拦截器

public final static String domainName = "192.168.2.123";

 

 

package com.web.interceptors;

import org.apache.log4j.Logger;
import org.apache.struts2.ServletActionContext;

import com.opensymphony.xwork2.ActionInvocation;
import com.opensymphony.xwork2.interceptor.AbstractInterceptor;
import com.trace.web.utils.Constants;

/**
 * 对管理员操作，校验Referer头，防范CSRF(跨站请求伪造)攻击的拦截器
 * @author admin
 */
public class AuthInterceptor extends AbstractInterceptor {

    private static final long serialVersionUID = -2154056039548254482L;

    private static Logger log = Logger.getLogger(AuthInterceptor.class);

    @Override
    public String intercept(ActionInvocation invocation) throws Exception {
        String referer = ServletActionContext.getRequest().getHeader("Referer");
        if((referer!=null) && (referer.trim().startsWith(Constants.HTTP + Constants.domainName))){
            return invocation.invoke();
        }
        log.info("referer : " + referer);
        return "error";
    }