如何使 servlet 只处理来自特定网站的请求？
我有一个 servlet 可以处理一些请求并相应地发出响应。
因此，如果我需要测试我的 servlet 是否运行良好，我只需直接在浏览器中输入 URL（如下）并检查响应。
http://localhost:8080/jnlpGenerator/create.htm?parameter1=someValue& ;parameter2=otherValue
这在测试期间没问题。
但是，我想阻止任何人直接从生产环境中的浏览器发送此网址。这可能吗？该网址仅适用于我的基于网络的项目。因此，当有人点击某个按钮时，它会发布上面的 url 来访问 servlet。
我怎样才能实现这个目标？
谢谢
I have a servlet that handles some request and sends out a response accordingly.
So if I need to test my servlet is working well, I would simply type the url (below) directly in the browser and check the response.
http://localhost:8080/jnlpGenerator/create.htm?parameter1=someValue¶meter2=otherValue
This is fine during testing.
However, I would like to stop anyone from sending through this url directly from the browser in the production environment. Is this possible? This url is only meant to be used within my web-based project. So when someone clicks on a certain button, it will post the above url to access the servlet.
How can I achieve this?
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
考虑编写一个授权
过滤器。但是，无法确定该请求是手动浏览器请求还是按下按钮的结果。您可以编写一些 JavaScript 函数来创造差异。
Consider writing an authorisation
Filter.However, there is no way to find out that the request is a result of a manual browser request or a button press. You can possibly write some JavaScript function to create a difference.
可能的方法：
Refererhttp标头，看看它是否来自某些源页面。POST方法，忽略GET方法（如果在浏览器中输入 URL，则直接发送）不应该依赖前两种方式，因为许多客户端（wget/curl/flashget/...）可以伪造
Referer标头或更改其请求方法，如下所示：Possible ways:
Refererhttp header of request to see if it's from certain source pages.POSTmethod, ignoreGETmethod (which is sent directly if type URL in browser)But, you should not rely on the previous 2 ways, because many clients (wget/curl/flashget/...) can fake
Refererheader or change their request method like the following:您无法阻止 URL 请求的发出 - 您基本上必须改变互联网的工作方式才能做到这一点。但是，您可以通过禁止单个或多个 IP 地址的访问或确保用户获得授权来阻止 servlet 处理这些请求。
为了防止未经授权的访问，授权过滤器和 getRemoteAddress()（如其他地方提到的）都可能有用，但您必须首先意识到一些基本的事情：
话虽如此，如果您只有一个简单的 Web 表单或一些同样微不足道的功能，您可能会使用验证码或其他一些随机令牌来防止误用：您的服务器将在每次表单时创建一个由两部分组成的随机项被调用，其中一部分显示在浏览器中，例如图像或字符序列，并且仅当发送请求包含相应的第二部分时才会被处理。
然而，如果您的项目更复杂，或者授权是基于用户身份的，您将必须更深入地研究安全概念，并实现会话处理、身份验证、加密等。有无数种方法可以做到这一点 - 首先了解一般的 Web 应用程序安全性，然后查看 Java 安全框架。
You cannot prevent URL requests from being made - you'd basically have to change the way the internet works to be able to do that. You can, however, prevent these requests from being processed by your servlet, by disallowing access for single or multiple IP addresses or making sure the user is authorized.
In order to prevent unauthorized access, both the authorization filter and `getRemoteAddress(), as mentioned elsewhere, can be useful, but you'll have to realize some basic things first:
Having said that, if you only have a simple web form, or some functionality that is equally trivial, you might well use a captcha or some other randomized token to prevent misuse: Your server will create a two-part randomized item each time the form is called, where one part is shown in the browser, such as an image or character sequence, and the send request will only be processed if it contains the corresponding second part.
If, however, your project is more complex, or authorization is based on user identity, you will have to look more deeply into security concepts, and implement session handling, authentication, encryption, etc.etc. There are countless ways of doing this - start by getting informed about web application security in general, then check out Java security frameworks.