servlet過濾器Filter使用之DelegatingFilterProxy類

　　正常情況下，我們需要添加一個過濾器，需要實現javax.servlet.Filter接口，再在web.xml中配置filter，如下：

package cc.eabour.webapp.security.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

public class XssFilter implements Filter {

    private String enable = null;
    
    public void init(FilterConfig filterConfig) throws ServletException {
        // Auto-generated method stub
        enable = filterConfig.getInitParameter("enable");
    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        // Auto-generated method stub
        // Do XSS Filter (WrapperRequest)
        chain.doFilter(request, response);
    }

    public void destroy() {
        // TODO Auto-generated method stub
        
    }

}

 

此時，web.xml中增加的配置：

 

    <filter>
        <filter-name>xssFilter</filter-name>
        <filter-class>cc.eabour.webapp.security.filter.XssFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>xssFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

 

　　那么，我們為什么要使用Spring的org.springframework.web.filter.DelegatingFilterProxy類呢？其中，最主要的目的還是我們添加的過濾器，需要使用spring中的某些bean，即委托Spring來管理過濾器的生命周期。當然，使用了這個代理類，需要設置參數targetFilterLifecycle為true才能讓spring來管理，否則就是一個正常的filter，其生命周期會被servlet容器管理。配置如下：

 

package cc.eabour.webapp.security.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;

import cc.eabour.webapp.service.IResourceService;

@Service("securityXssFilter")
public class XssFilter implements Filter {

    private String enable = null;
    
    @Autowired
    private IResourceService reosurceService;
    
    
    public void init(FilterConfig filterConfig) throws ServletException {
        // Auto-generated method stub
        enable = filterConfig.getInitParameter("enable");
    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        // Auto-generated method stub
        // Do XSS Filter (WrapperRequest)
        reosurceService.work();
        chain.doFilter(request, response);
    }

    public void destroy() {
        // TODO Auto-generated method stub
        
    }

}

 

 web.xml配置：

    <filter>
        <filter-name>securityXssFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
        <init-param>
            <param-name>targetFilterLifecycle</param-name>
            <param-value>true</param-value>
        </init-param>
        <!-- 可以添加自定義參數 -->
        <init-param>
            <param-name>enable</param-name>
            <param-value>true</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>securityXssFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

　　Spring在初始化過濾器的時候，會根據過濾器的名稱去尋找對應代理的過濾器，也可以通過參數targetBeanName參數來制定對應的過濾器bean名稱。如果把初始化參數targetFilterLifecycle修改為false或不添加，則代理的過濾器為普通的，不受Spring管理。

 

　　以下為摘自Spring的文檔：

Proxy for a standard Servlet Filter, delegating to a Spring-managed bean that implements the Filter interface. Supports a "targetBeanName" filter init-param in web.xml, specifying the name of the target bean in the Spring application context.

web.xml will usually contain a DelegatingFilterProxy definition, with the specified filter-name corresponding to a bean name in Spring's root application context. All calls to the filter proxy will then be delegated to that bean in the Spring context, which is required to implement the standard Servlet Filter interface.

 

This approach is particularly useful for Filter implementation with complex setup needs, allowing to apply the full Spring bean definition machinery to Filter instances. Alternatively, consider standard Filter setup in combination with looking up service beans from the Spring root application context.

 

NOTE: The lifecycle methods defined by the Servlet Filter interface will by default not be delegated to the target bean, relying on the Spring application context to manage the lifecycle of that bean. Specifying the "targetFilterLifecycle" filter init-param as "true" will enforce invocation of the Filter.init and Filter.destroy lifecycle methods on the target bean, letting the servlet container manage the filter lifecycle.