解决跨站脚本注入，跨站伪造用户请求，sql注入等http安全漏洞

request.getSession().invalidate() ;         //清空session
if (request.getCookies()!=null) {
Cookie cookie = request.getCookies()[0];     // 获取cookie
cookie.setMaxAge(0);                    // 让cookie过期
}"

<login-config>
<!-- Authorization setting for SSL -->
<auth-method>CLIENT-CERT</auth-method>
<realm-name>Client Cert Users-only Area</realm-name>
<auth-method>BASIC</auth-method>
</login-config>
<security-constraint>
<!-- Authorization setting for SSL -->
<web-resource-collection>
<web-resource-name>SSL</web-resource-name>
<url-pattern>/oa/login.jsp</url-pattern>
</web-resource-collection>

<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>

<!-- 禁止不安全的http方法 -->
<security-constraint>
<web-resource-collection>
<web-resource-name>fortune</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>PUT</http-method>
<http-method>DELETE</http-method>
<http-method>HEAD</http-method>
<http-method>OPTIONS</http-method>
<http-method>TRACE</http-method>
</web-resource-collection>
<auth-constraint></auth-constraint>
</security-constraint>

package com.asiainfo.aiga.common.filter;

import java.io.IOException;
import java.util.Enumeration;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.lang3.StringUtils;

public class XSSCheckFilter implements Filter
{
private FilterConfig config;
private static String errorPath;//出错跳转的目的地
private static String[] excludePaths;//不进行拦截的url
private static String[] safeless = { "<script", //需要拦截的JS字符关键字
"</script", "<iframe", "</iframe", "<frame", "</frame", "set-cookie", "%3cscript", "%3c/script", "%3ciframe", "%3c/iframe", "%3cframe", "%3c/frame", "src=\"javascript:", "<body", "</body", "%3cbody", "%3c/body", "alert", "script", "document", "document.title", "document.write", "eval", "prompt", "onreadystatechange", "javascript", "msgbox"
//"<",
//">",
//"</",
//"/>",
//"%3c",
//"%3e",
//"%3c/",
//"/%3e"
};

public void doFilter(ServletRequest req, ServletResponse resp, FilterChain filterChain) throws IOException, ServletException
{
Enumeration params = req.getParameterNames();
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) resp;

boolean isSafe = true;
String requestUrl = request.getRequestURI();
if (isSafe(requestUrl))
{
requestUrl = requestUrl.substring(requestUrl.indexOf("/"));
if (!excludeUrl(requestUrl))
{
while (params.hasMoreElements())
{
String cache = req.getParameter((String) params.nextElement());
if (StringUtils.isNotBlank(cache))
{
if (!isSafe(cache))
{
isSafe = false;
break;
}
}
}
}
}
else
{
isSafe = false;
}
if (!isSafe)
{
request.setAttribute("msg", "There is some illegal characters in paramters.");
request.getRequestDispatcher(errorPath).forward(request, response);
return;
}
else
{
String referer = request.getHeader("referer");
if (!("/index.jsp".equals(request.getServletPath()) || "/refresh.jsp".equals(request.getServletPath())))
{
if(request.getServletPath()!=null&&request.getServletPath().endsWith(".action")){

}else if (referer == null || !referer.contains(request.getServerName()))
{
System.out.println("跨站请求伪造");
//转到一个错误的图片
request.getRequestDispatcher(errorPath).forward(request, response);
}
}
}
filterChain.doFilter(req, resp);
}

private static boolean isSafe(String str)
{
if (StringUtils.isNotBlank(str))
{
for (String s : safeless)
{
String[] strs = str.split("/");
for (String urlStr : strs)
{
if (s.equals(urlStr.toLowerCase()))
{
return false;
}
}
}
}
return true;
}

private boolean excludeUrl(String url)
{
if (excludePaths != null && excludePaths.length > 0)
{
for (String path : excludePaths)
{
if (url.toLowerCase().equals(path))
{
return true;
}
}
}
return false;
}

public void destroy()
{
}

public void init(FilterConfig config) throws ServletException
{
this.config = config;
errorPath = config.getInitParameter("errorPath");
String excludePath = config.getInitParameter("excludePaths");
if (StringUtils.isNotBlank(excludePath))
{
excludePaths = excludePath.split(",");
}
}
}