springboot 拦截器校验签名后controller就获取不到数据

骑猪看日落 2022-01-15 00:17 661阅读 0赞

SpringBoot项目，有个需求就是要加一个拦截器和过滤器，在拦截器中我需要获取到前端传过来的json数据进行签名校验，按照常理来说，获取请求body中的参数就可以，方法写好后，在拦截器中也读取到了body请求参数。但是出现一个问题，就是后面的controller中使用了@RequestBody注解获取参数，但是拦截器执行过后，controller获取不到参数，甚至是方法都没有进入对应的方法中就报错了(注：拦截器中不使用流，controller中是能获取到参数的)。  
在debug过程中，发现拦截器使用流和不适用流到了一个获取字符集解析器的方法里面就有差别了。一个是能获取到字符集解析器。另一个获取不到。但是看了执行过程也没发现什么问题。就百度了一下，发现了Spring有一个问题就是： ServletRequest中getReader()和getInputStream()只能调用一次。而又由于@RequestBody注解获取输出参数的方式也是根据流的方式获取的。所以我们前面使用流获取后，后面的@RequestBody就获取不到对应的输入流了。

从网上查找了一下，有一个方法就是。先使用过滤读取流，然后在将流复制一份保留在request中这样后面controller就可以获取到了。

过滤器：

public class BodyReaderRequestWrapper extends HttpServletRequestWrapper {
    
        private final byte[] body;
    
        public BodyReaderRequestWrapper(HttpServletRequest request) throws IOException {
            super(request);
            String sessionStream = getBodyString(request);
            body = sessionStream.getBytes(Charset.forName("UTF-8"));
        }
    
        /**
         * 获取请求Body
         */
        public String getBodyString(final ServletRequest request) {
            StringBuilder sb = new StringBuilder();
            InputStream inputStream = null;
            BufferedReader reader = null;
            try {
                inputStream = cloneInputStream(request.getInputStream());
                reader = new BufferedReader(new InputStreamReader(inputStream, Charset.forName("UTF-8")));
                String line = "";
                while ((line = reader.readLine()) != null) {
                    sb.append(line);
                }
            }
            catch (IOException e) {
                e.printStackTrace();
            }
            finally {
                if (inputStream != null) {
                    try {
                        inputStream.close();
                    }
                    catch (IOException e) {
                        e.printStackTrace();
                    }
                }
                if (reader != null) {
                    try {
                        reader.close();
                    }
                    catch (IOException e) {
                        e.printStackTrace();
                    }
                }
            }
            return sb.toString();
        }
    
        /**
         * Description: 复制输入流
         */
        public InputStream cloneInputStream(ServletInputStream inputStream) {
            ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
            byte[] buffer = new byte[1024];
            int len;
            try {
                while ((len = inputStream.read(buffer)) > -1) {
                    byteArrayOutputStream.write(buffer, 0, len);
                }
                byteArrayOutputStream.flush();
            }
            catch (IOException e) {
                e.printStackTrace();
            }
            InputStream byteArrayInputStream = new ByteArrayInputStream(byteArrayOutputStream.toByteArray());
            return byteArrayInputStream;
        }
        @Override
        public BufferedReader getReader() throws IOException {
            return new BufferedReader(new InputStreamReader(getInputStream()));
        }
    
        @Override
        public ServletInputStream getInputStream() throws IOException {
    
            final ByteArrayInputStream bais = new ByteArrayInputStream(body);
    
            return new ServletInputStream() {
    
                @Override
                public int read() throws IOException {
                    return bais.read();
                }
    
                @Override
                public boolean isFinished() {
                    return false;
                }
    
                @Override
                public boolean isReady() {
                    return false;
                }
    
                @Override
                public void setReadListener(ReadListener readListener) {
                }
            };
        }
    }

实现过滤器，所有request进行包装：

@WebFilter(urlPatterns = "/*", filterName = "InterfaceFilter")
    public class InterfaceFilter implements Filter {
    
        @Override
        public void init(FilterConfig filterConfig) throws ServletException {
    
        }
    
        @Override
        public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
            // 防止流读取一次后就没有了, 所以需要将流继续写出去
            HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest;
            // 这里将原始request传入，读出流并存储
            ServletRequest requestWrapper = new  BodyReaderRequestWrapper(httpServletRequest);
            // 这里将原始request替换为包装后的request，此后所有进入controller的request均为包装后的
            filterChain.doFilter(requestWrapper, servletResponse);// 
        }
    
        @Override
        public void destroy() {
    
        }
    }

把body请求参数复制后就可以在拦截器中获取参数进行校验了

拦截器：

@Configuration
    public class SignCheckConfig extends WebMvcConfigurationSupport {
    
        @Resource
        private SysParaMemService sysParaMemService;
        @Value("${spring.profiles.active}")
        private String env = "";
    
        public void addInterceptors(InterceptorRegistry registry) {
            registry.addInterceptor(new SignInterceptor())
                    .addPathPatterns("/**");
            super.addInterceptors(registry);
        }
    
        /**
         * 签名验证器
         */
        private class SignInterceptor extends HandlerInterceptorAdapter {
            @Override
            public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
                if (!(HttpMethod.POST.name().equals(request.getMethod()))) {
                    return true;
                }
    
                if (server_env_dev.toLowerCase().equals(env)) {
                    return true;
                }
    
                BodyReaderRequestWrapper servletRequestWrapper = new BodyReaderRequestWrapper(request);
                String params = servletRequestWrapper.getBodyString(request);
                if (StringUtils.isEmpty(params)) {
                    request.getRequestDispatcher("/wap/user/checksign").forward(request, response);
                }
                JSONObject jsonObject = JSONObject.fromObject(params);
    
                String data = jsonObject.optString("data");
                String signc = jsonObject.optString("sign");
    
                String sign = SignUtils.compMd5Sign(data + sysParaMemService.getSignKey());
                if (!(sign.equals(signc))) {
                    // 该服务会抛出验签失败异常
                    request.getRequestDispatcher("/wap/user/checksign").forward(request, response);
                }
                return true;
            }
        }
    }

主要代码就是：

> BodyReaderRequestWrapper servletRequestWrapper = new BodyReaderRequestWrapper(request);  
> String params = servletRequestWrapper.getBodyString(request);