【Head First Servlets and JSP】笔记 27： web 应用安全

典型的安全问题：假冒者、窃听者、非法升级者
认证方式： Base64 、摘要认证、客户端证书、表单认证，重点熟悉摘要算法（ HASH 、 MD5 等）
安全机制：授权、认证、数据完整性、机密性

80 端口、 443 端口
通过 HTTP 、 HTTPS 传输数据的区别， SSL 等概念
重放攻击、 SQL 注入等

【参考】

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
         version="3.1">

    <!-- Define servlets that are included in the web application -->

    <servlet>
        <servlet-name>jack</servlet-name>
        <servlet-class>sample.Jack</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet>
        <servlet-name>dog</servlet-name>
        <servlet-class>sample.Dog</servlet-class>
        <load-on-startup>2</load-on-startup>
        <security-role-ref>
            <role-name>VIP</role-name>
            <role-link>Member</role-link>
        </security-role-ref>
    </servlet>


    <servlet-mapping>
        <servlet-name>jack</servlet-name>
        <url-pattern>/abc/*</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>dog</servlet-name>
        <url-pattern>/abc/3</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>dog</servlet-name>
        <url-pattern>*.do</url-pattern>
    </servlet-mapping>


    <error-page>
        <exception-type>java.lang.Throwable</exception-type>
        <location>/WEB-INF/jsp/exception/common-exception.jsp</location>
    </error-page>
    <error-page>
        <error-code>404</error-code>
        <location>/WEB-INF/jsp/exception/404-exception.jsp</location>
    </error-page>

    <welcome-file-list>
        <welcome-file>index.html</welcome-file>
        <welcome-file>abc/3</welcome-file>
        <welcome-file>index.jsp</welcome-file>
    </welcome-file-list>

    <security-role>
        <role-name>Admin</role-name>
    </security-role>
    <security-role>
        <role-name>Member</role-name>
    </security-role>
    <security-role>
        <role-name>Guest</role-name>
    </security-role>

    <!--<login-config>-->
        <!--<auth-method>BASIC 明文认证</auth-method>-->
    <!--</login-config>-->
    <!--<login-config>-->
        <!--<auth-method>DIGEST 摘要认证</auth-method>-->
    <!--</login-config>-->
    <!--<login-config>-->
        <!--<auth-method>CLIENT-CERT 客户端证书</auth-method>-->
    <!--</login-config>-->
    <login-config>
        <auth-method>FORM</auth-method>
        <form-login-config>
            <form-login-page>/loginPage.jsp</form-login-page>
            <form-error-page>/loginError.jsp</form-error-page>
        </form-login-config>
    </login-config>

    <security-constraint>

        <web-resource-collection>
            <web-resource-name>UpdateRecipe</web-resource-name>
            <url-pattern>/abc/3</url-pattern>
            <http-method>GET</http-method>
        </web-resource-collection>

        <auth-constraint>
            <role-name>Admin</role-name>
            <role-name>Member</role-name>
        </auth-constraint>

        <!--<user-data-constraint>-->
            <!--<transport-guarantee>CONFIDENTIAL</transport-guarantee>-->
        <!--</user-data-constraint>-->
        <!-- 对资源进行传输保证（不至于明文传输密码）
        tomcat 需要开启 8443 端口，并且需要一个证书，涉及到 HTTPS、SSL 等安全协议 -->
    </security-constraint>

</web-app>

loginPage.jsp ：

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Authorization</title>
</head>
<body>
    <form method="post" action="j_security_check">
        <p><input type="text" name="j_username" /></p>
        <p><input type="secret" name="j_password" /></p>
        <p><input type="submit" value="Enter"></p>
    </form>
</body>
</html>

Servlet ：

package sample;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;

public class Dog extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        resp.setContentType("text/html");
        PrintWriter out = resp.getWriter();
        if (req.isUserInRole("VIP")) { // 【授权】程序式授权，对应的是在 web.xml 中的声明式授权
            out.println("Only VIP can see.");
            out.println(req.getRemoteUser()); // 【认证】确认用户身份，打印出来是 username
        }
        out.println("he is not jack.");
    }
}