时间：2023-02-09 05:48:01 | 来源：建站知识
时间：2023-02-09 05:48:01 来源：建站知识
在线咨询
1. 登陆跳转我认为是最常见的跳转类型，认证完后会跳转，所以在登陆的时候建议多观察url参数2. 用户分享、收藏内容过后，会跳转3. 跨站点认证、授权后，会跳转4. 站内点击其它网址链接时，会跳转5. 在一些用户交互页面也会出现跳转，如请填写对客服评价，评价成功跳转主页，填写问卷，等等业务，注意观察url。6. 业务完成后跳转这可以归结为一类跳转，比如修改密码，修改完成后跳转登陆页面，绑定银行卡，绑定成功后返回银行卡充值等页面，或者说给定一个链接办理VIP，但是你需要认证身份才能访问这个业务，这个时候通常会给定一个链接，认证之后跳转到刚刚要办理VIP的页面。url跳转常用到的参数redirecturlredirectUrlcallbackreturn_urltoUrlReturnUrlfromUrlredUrlrequestredirect_toredirect_urljumpjump_totargettogotolinklinktodomainoauth_callback@GetMapping("/redirect")public String redirect(@RequestParam("url") String url) { return "redirect:" + url;}301跳转：@RequestMapping("/setHeader")@ResponseBodypublic static void setHeader(HttpServletRequest request, HttpServletResponse response) { String url = request.getParameter("url"); response.setStatus(HttpServletResponse.SC_MOVED_PERMANENTLY); // 301 redirect response.setHeader("Location", url);}302跳转：@RequestMapping("/sendRedirect")@ResponseBodypublic static void sendRedirect(HttpServletRequest request, HttpServletResponse response) throws IOException { String url = request.getParameter("url"); response.sendRedirect(url); // 302 redirect}@RequestMapping("/forward")@ResponseBodypublic static void forward(HttpServletRequest request, HttpServletResponse response) { String url = request.getParameter("url"); RequestDispatcher rd = request.getRequestDispatcher(url); try { rd.forward(request, response); } catch (Exception e) { e.printStackTrace(); }}通过checkURL去检查输入的参数 @RequestMapping("/sendRedirect/sec") @ResponseBody public void sendRedirect_seccode(HttpServletRequest request, HttpServletResponse response) throws IOException { String url = request.getParameter("url"); if (SecurityUtil.checkURL(url) == null) { response.setStatus(HttpServletResponse.SC_FORBIDDEN); response.getWriter().write("url forbidden"); return; } response.sendRedirect(url); }}跟进/** * 同时支持一级域名和多级域名，相关配置在resources目录下url/url_safe_domain.xml文件。 * 优先判断黑名单，如果满足黑名单return null。 * * @param url the url need to check * @return Safe url returns original url; Illegal url returns null; */public static String checkURL(String url) { if (null == url){ return null; } ArrayList<String> safeDomains = WebConfig.getSafeDomains(); ArrayList<String> blockDomains = WebConfig.getBlockDomains(); try { String host = gethost(url); // 必须http/https if (!isHttp(url)) { return null; } // 如果满足黑名单返回null if (blockDomains.contains(host)){ return null; } for(String blockDomain: blockDomains) { if(host.endsWith("." + blockDomain)) { return null; } } // 支持多级域名 if (safeDomains.contains(host)){ return url; } // 支持一级域名 for(String safedomain: safeDomains) { if(host.endsWith("." + safedomain)) { return url; } } return null; } catch (NullPointerException e) { logger.error(e.toString()); return null; }}检测相关url是否在自己配置中，若不在则返回NULL关键词：
