当前位置：首页 > news >正文

HTTPS请求头缺少HttpOnly和Secure属性解决方案

news 来源：原创 2024/9/17 3:50:25

问题描述：
在这里插入图片描述

建立Filter拦截器类

package com.ruoyi.framework.security.filter;import com.ruoyi.common.core.domain.model.LoginUser;
import com.ruoyi.common.utils.SecurityUtils;
import com.ruoyi.common.utils.StringUtils;
import com.ruoyi.framework.web.service.TokenService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.stereotype.Component;import javax.servlet.*;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;/*** token过滤器 验证token有效性** @author ruoyi*/
@Component
public class JwtAuthenticationTokenFilter implements Filter {@Autowiredprivate TokenService tokenService;@Value("${token.expireTime}")private int expireTime;@Overridepublic void init(FilterConfig filterConfig) throws ServletException {}@Overridepublic void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {HttpServletRequest request = (HttpServletRequest) servletRequest;HttpServletResponse response = (HttpServletResponse) servletResponse;LoginUser loginUser = tokenService.getLoginUser(request);if (StringUtils.isNotNull(loginUser) && StringUtils.isNull(SecurityUtils.getAuthentication())) {tokenService.verifyToken(loginUser);UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(loginUser, null, loginUser.getAuthorities());authenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));SecurityContextHolder.getContext().setAuthentication(authenticationToken);Cookie[] cookies = request.getCookies();if (cookies != null) {for (Cookie cookie : cookies) {String value = cookie.getValue();String builder = "JSESSIONID=" + value + "; " +"Secure; " +"HttpOnly; " +"Expires=" + expireTime;response.setHeader("Set-Cookie", builder);}}}filterChain.doFilter(request, response);}@Overridepublic void destroy() {}}