浅析SpringBoot实现防盗链的五大常见漏洞和解决方法

// 错误示例：仅依赖Referer校验
String referer = request.getHeader("Referer");
if (referer == null || !referer.contains("yourdomain.com")) {
    return handleForbidden(response);
}

// 错误示例：忽略微信浏览器Referer丢失
String referer = request.getHeader("Referer");
if (referer == null || !referer.contains("yourdomain.com")) {
    return handleForbidden(response);
}

// 错误示例：未处理CDN代理穿透
String referer = request.getHeader("Referer");
String realIP = request.getRemoteAddr();
if (referer == null || !referer.contains("yourdomain.com") || !realIP.contains("your-ip")) {
    return handleForbidden(response);
}

// 错误示例：不使用动态Token验证
String referer = request.getHeader("Referer");
if (referer == null || !referer.contains("yourdomain.com")) {
    return handleForbidden(response);
}

// 错误示例：未实现流量监控
String referer = request.getHeader("Referer");
if (referer == null || !referer.contains("yourdomain.com")) {
    return handleForbidden(response);
}

@Component
public class ImageAntiHotlinkInterceptor implements HandlerInterceptor {

    private static final List<String> ALLOWED_DOMAINS = Arrays.asList(
        "https://www.yourdomain.com",
        "https://m.yourdomain.com"
    );

    private static final List<String> WHITELIST_PATHS = Arrays.asList(
        "/api/public/**",
        "/images/public/**"
    );

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        // 1. 白名单路径直接放行
        if (isWhitelistPath(request.getRequestURI())) {
            return true;
        }

        // 2. 检查Referer
        if (!isAllowedReferer(request)) {
            return handleForbidden(response);
        }

        // 3. 检查IP（处理CDN穿透）
        if (!isAllowedIP(request)) {
            return handleForbidden(response);
        }

        // 4. 检查Token（动态验证）
        if (!isAllowedToken(request)) {
            return handleForbidden(response);
        }

        return true;
    }

    private boolean isAllowedReferer(HttpServletRequest request) {
        String referer = request.getHeader("Referer");
        if (referer == null) {
            // 微信浏览器Referer丢失处理
            String ua = request.getHeader("User-Agent");
            if (ua != null && ua.contains("MicroMessenger")) {
                return true; // 微信浏览器直接放行
            }
            return false;
        }
        String refererHost = extractHost(referer);
        return ALLOWED_DOMAINS.stream().anyMatch(domain -> refererHost.contains(domain));
    }

    private boolean isAllowedIP(HttpServletRequest request) {
        String xForwardedFor = request.getHeader("X-Forwarded-For");
        if (xForwardedFor != null && !xForwardedFor.isEmpty()) {
            return xForwardedFor.split(",")[0].trim().equals("your-real-ip");
        }
        return request.getRemoteAddr().equals("your-real-ip");
    }

    private boolean isAllowedToken(HttpServletRequest request) {
        String token = request.getParameter("token");
        String timestamp = request.getParameter("t");
        return token != null && timestamp != null && isValidToken(token, timestamp);
    }

    private boolean isValidToken(String token, String timestamp) {
        // 实际实现：验证Token和时间戳
        return true; // 示例
    }

    private boolean isWhitelistPath(String uri) {
        return WHITELIST_PATHS.stream().anyMatch(pattern -> 
            PathMatcher.match(pattern, uri));
    }

    private String extractHost(String url) {
        try {
            return new URL(url).getHost();
        } catch (MalformedURLException e) {
            return url;
        }
    }

    private boolean handleForbidden(HttpServletResponse response) {
        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        return false;
    }
}

@Component
public class TokenGenerator {

    private static final int TOKEN_EXPIRY_MINUTES = 30;
    private static final String SECRET_KEY = "your-secret-key";

    public String generateToken(String userId) {
        long timestamp = System.currentTimeMillis() / 1000;
        String token = Base64.getEncoder().encodeToString(
            (userId + timestamp + SECRET_KEY).getBytes()
        );
        return URLEncoder.encode(token, StandardCharsets.UTF_8.name()) + "&t=" + timestamp;
    }

    public boolean validateToken(String token, String timestamp) {
        if (timestamp == null) return false;
        
        long currentTime = System.currentTimeMillis() / 1000;
        long tokenTime = Long.parseLong(timestamp);
        
        // 检查时间戳是否在有效期内
        if (currentTime - tokenTime > TOKEN_EXPIRY_MINUTES * 60) {
            return false;
        }
        
        // 验证Token
        String expectedToken = Base64.getEncoder().encodeToString(
            (/* 用户ID */ + tokenTime + SECRET_KEY).getBytes()
        );
        
        return token.equals(expectedToken);
    }
}

@Component
public class TrafficMonitor {

    private static final int MAX_REQUESTS_PER_MINUTE = 100;
    private final Map<String, AtomicInteger> requestCountMap = new ConcurrentHashMap<>();

    public boolean isRequestAllowed(HttpServletRequest request) {
        String ip = getRemoteIP(request);
        String resource = request.getRequestURI();
        
        String key = ip + ":" + resource;
        AtomicInteger count = requestCountMap.computeIfAbsent(key, k -> new AtomicInteger(0));
        
        // 检查请求频率
        if (count.get() >= MAX_REQUESTS_PER_MINUTE) {
            // 记录异常
            log.error("Too many requests from IP: {}, resource: {}", ip, resource);
            return false;
        }
        
        count.incrementAndGet();
        return true;
    }

    private String getRemoteIP(HttpServletRequest request) {
        String xForwardedFor = request.getHeader("X-Forwarded-For");
        if (xForwardedFor != null && !xForwardedFor.isEmpty()) {
            return xForwardedFor.split(",")[0].trim();
        }
        return request.getRemoteAddr();
    }

    @PostConstruct
    public void init() {
        // 定期清理过期计数
        ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor();
        scheduler.scheduleAtFixedRate(() -> {
            requestCountMap.forEach((key, count) -> {
                if (System.currentTimeMillis() - count.get() > 60000) {
                    requestCountMap.remove(key);
                }
            });
        }, 0, 60, TimeUnit.SECONDS);
    }
}

String ua = request.getHeader("User-Agent");
if (ua != null && ua.contains("MicroMessenger")) {
    return true; // 微信浏览器直接放行
}

String xForwardedFor = request.getHeader("X-Forwarded-For");
if (xForwardedFor != null && !xForwardedFor.isEmpty()) {
    return xForwardedFor.split(",")[0].trim();
}
return request.getRemoteAddr();

SecureRandom random = new SecureRandom();
byte[] tokenBytes = new byte[32];
random.nextBytes(tokenBytes);
String token = Base64.getEncoder().encodeToString(tokenBytes);