Implement anti-theft chain through referer request header

adopt Referer Request head realizes anti-theft chain

Stealing chain : Other sites connect to our own sites through hyperlinks, and the act of stealing our resources is called chain theft . 

Referer Request header : Represents the page from which you are currently accessing .

 

Example:

Join us for a news website , With the efforts of relevant personnel, I finally got a big news , So we put the news on the official homepage of our website , Access through hyperlinks .

 

<a href="${pageContext.request.contextPath }/NewsServlet"> Big news </a>

@WebServlet("/NewsServlet")
public class NewsServlet extends HttpServlet {
private static final long serialVersionUID = 1L;

protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
response.setContentType("text/html;charset=utf-8");

response.getWriter().write(" This great Xia eats steamed stuffed buns ....");
}


protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
doGet(request, response);
}
}

 

Now there is another website , www.xianglang.com There is no news , Seeing that the news is very popular, I added the following hyperlinks to my homepage

 

<a href="http://localhost/Day04-Response-Request/NewsServlet"> Big news </a>

 

such , The resources we try hard to get are easily stolen by others , This is chain theft .

 

In order to prevent this behavior, we can pass Referer Request head realizes anti-theft chain :

modify NewsServlet as follows :

 

@WebServlet("/NewsServlet")
public class NewsServlet extends HttpServlet {
private static final long serialVersionUID = 1L;

protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
response.setContentType("text/html;charset=utf-8");

String referer = request.getHeader("Referer");
if(referer == null || "".equals(referer) || !referer.contains("localhost/")) {
response.sendRedirect(request.getContextPath() + "/index.jsp");
return;
}

response.getWriter().write(" This great Xia eats steamed stuffed buns ....");
}

protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
doGet(request, response);
}
}

 

When Referer If you don't exist or visit our resources from other sites, you can directly redirect to our home page , This can prevent our resources from being stolen , And you can slowly convert users of other sites trying to steal the chain into users of our site .

 

Be careful : After redirection return, Otherwise, resources will also be stolen .