首页 > 解决方案 > java防止标头,cookie注入?

问题描述

今天在工作时,我发现了一个奇怪的问题,我从来没有遇到过我的客户在我的一个发布请求中添加了查询参数,它被添加到响应标头中,在我的过滤器中我没有将它添加到标头中,它会自动添加:

http://localhost:9898/app/rest/data/fetch 

这是我的 Post 请求,但是当用户向其中添加查询参数时:

http://localhost:9898/app/rest/data/fetch?Location=https://www.google.com/

这被添加到响应头中:

accept →*/*
accept-encoding →gzip, deflate, br
accept-language →en-US,en;q=0.9
auth-token →eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkExMjhDQkMtSFMyNTYiLCJjdHkiOiJqd3QifQ.dFChYC8aWe7E0Dvsvy7cRRKlQnNqH3Yzdgkoaa3Eq3tuc-w4fGryP_H01dgx_PbNnXcGGZoiuZ73hB60RYTWC8A2zKB-hULWY09uVkaQcNrXlFIHg0Rf5nfa91uK-peABNe5Tsp7oEjZcrgGVYAZx5B3DzU9SKxLwai6QTf9zNHapIP043hBgxJWl5Pn-851K1I37SNp7pW5WolGDGH2xN6jUpc4L0QM759RbfIBw2uGVuZbR6v5OQ7ePbD3pj06mSL6XZkN0Dyiahfat0tse3SrAs73j_l6yXuQeyy0goypbtAANSg2O4R-1m_-0Hwq4Ew2zbwkSOJXnpWOc9HFSg.p4k4CsxQN2G_I_pCMbQiWg.BvbSir5Z2bY2T8Pgu1EOFN1Cbq4TEBRmotVzW9LsEhDCnZIgvI0elUu8gC2p0n2rldJ_01jKM4s2jcQwTW43enRqXJjilMBXctErB3Mv2uqwe4bRM92IlPpLNqJOHwna0lNOPzQeXA9lqTWgEpo8lGA2sPqRrl3oIS68OjmsDSc5T6PdXmcKq1n-j2214h8GogMVutNKSeZ7S3NmSD59ygeWZwAKqsSf8HDzJS7UqaXUDuDk1YW3EEco4OdKDlm4UBVys0JSRotSvbFl-FowvuCurNIJZoOuJY9DE7-cZdNMrKKZ8zAhp64V8CeSAJmIXetxyEoVCw9-K745XTPm9pzf3Jt1v3Cic0h92E3zFNzh9_Co8dQEw2CAhifKcnx1QXcG30X306iixK0lSJblKrQzRTTmSjtADu9C_KDqrO4y04edxcI6ARCDsHCF3GiiAxlkuueIqeXiLzonwBZrvSxcRrv2c4xiVkJQ7wimNJ58biuiWJ4p-59oCt3a-h8EsfMrlnJk7M_J0xIKNZdXE4QjuN-iR8rTr-IffF2XcSycTtALJB1AFOU7ZCNRYSenjHaE02_Hxu4xYfJ2HKoyTy30eQj8EhnlkZgYPPJ4MHKACTZboJBwdRV6uaxyrMc2uA7CNP3wSDCGnEBeVL2qXpebqF3uplTj_y0ZtQsH6eBTx4Pbh8-b7MfkQxlwtlpfICACf7C4qkYyF9dNUwHs6Q.Y7ZgeEyxZz86xAddlgH1mQ
breadcrumbid →ID-LAPTOP-3KEFOF60-60042-1635422818548-0-50
**Location →https://www.google.com/**

我们如何避免这种情况,就像用户添加其他内容一样,它被添加到标题中:

http://localhost:9898/app/rest/data/fetch?SET-COOKIE=fdgfdgfdgdg

等等我只是允许请求:

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {

    HttpServletRequest req = (HttpServletRequest) request;
    HttpServletResponse res = (HttpServletResponse) response;
    chain.doFilter(request, response);
    return;

 }

请帮助我们如何防止这种注射?

标签: javatomcatjava-8

解决方案


推荐阅读