如何修复跨域资源共享漏洞？

下面提供一种常见的修复跨域资源共享（CORS）漏洞的代码实现方式，可用于限制非法来源访问并增强接口安全性：

public class RefererFilter implements Filter {private static Logger logger = LoggerFactory.getLogger(RefererFilter.class);private final String ORIGIN = "Origin";private final String REFERER = "referer";/** 允许访问的域名列表 */private List allowDomainList = new ArrayList();/** 过滤器忽略处理的url规则 */
private List excludes = new ArrayList();
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
if (logger.isDebugEnabled()) {
logger.debug("referer filter is open");
}

// 判断该url是否需要过滤
HttpServletRequest req = (HttpServletRequest) request;
HttpServletResponse resp = (HttpServletResponse) response;
if (handleExcludeURL(req, resp)) {
chain.doFilter(request, response);
return;
}

if (null != allowDomainList && !allowDomainList.isEmpty()) {
logger.info("referer过滤");
String origin = req.getHeader(ORIGIN);
// 获取referer域
String referer = getRefererDomain(req.getHeader(REFERER));
logger.info("origin={}, referer={}", origin, referer);
if (origin == null || (allowDomainList.contains(origin) && (allowDomainList.contains(referer)))) {
// 有值则继续执行下一个过滤链
chain.doFilter(request, response);
} else {
// 非法来源请求，服务器拒绝访问
resp.setStatus(HttpStatus.FORBIDDEN.value());
}
} else {
chain.doFilter(request, response);
}
}

@Override
public void init(FilterConfig filterConfig) throws ServletException {
if (logger.isDebugEnabled()) {
logger.debug("referer filter init ====================");
}
String excludesTemp = filterConfig.getInitParameter("excludes");
if (excludesTemp != null) {
String[] url = excludesTemp.split(",");
for (int i = 0; url != null && i excludes.add(url[i]);
}
}
logger.info("excludes={}", excludes);

String allowDomainListTemp = filterConfig.getInitParameter("allowDomainList");
if (allowDomainListTemp != null) {
String[] url = allowDomainListTemp.split(",");
for (int i = 0; url != null && i allowDomainList.add(url[i]);
}
}
logger.info("allowDomainList={}", allowDomainList);
}

/**
* @param request
* @param response
* @return
*/
private boolean handleExcludeURL(HttpServletRequest request, HttpServletResponse response) {
if (excludes == null || excludes.isEmpty()) {
return false;
}
String url = request.getServletPath();
logger.info("校验{}是否需要referer过滤。", url);
for (String pattern : excludes) {
Pattern p = Pattern.compile("^" + pattern);
Matcher m = p.matcher(url);
if (m.find()) {
return true;
}
}
return false;
}



/**
* 获取referer域名
*
* @param refererUrl
* @return
*/
private static String getRefererDomain(String referer) {
String result = referer;
if (StringUtils.isNotBlank(referer)) {
if (referer.startsWith("https://")) {
int i = referer.substring(8).indexOf("/");
if (i > 0) {
result = referer.substring(0, 8 + i);
}
} else if (referer.startsWith("https://")) {
int i = referer.substring(7).indexOf("/");
if (i > 0) {
result = referer.substring(0, 7 + i);
}
}
}
return result;
}
}