一，疑问
1.之前遇到跨域问题是在NG中解决的，添加跨域请求头和域名配置。那么与网关处理跨域问题关系是什么，NG处理了，为什么还需要在网关中处理
二，前置知识
zuul概念与原理
zuul 的概念和原理 - 知乎
Zuul工作原理_zuul原理_吴声子夜歌的博客-CSDN博客
梳理几个基本概念
zuul的工作原理
1.过滤器机制
zuul的核心是一系列的filters, 其作用可以类比Servlet框架的Filter，或者AOP。
zuul把Request route到 用户处理逻辑 的过程中，这些filter参与一些过滤处理，比如Authentication，Load Shedding等
2.过滤器机制过滤器类型
Zuul大部分功能都是通过过滤器来实现的。Zuul中定义了四种标准过滤器类型，这些过滤器类型对应于请求的典型生命周期。
(1) PRE：这种过滤器在请求被路由之前调用。我们可利用这种过滤器实现身份验证、在集群中选择请求的微服务、记录调试信息等。
(2) ROUTING：这种过滤器将请求路由到微服务。这种过滤器用于构建发送给微服务的请求，并使用Apache HttpClient或Netfilx Ribbon请求微服务。
(3) POST：这种过滤器在路由到微服务以后执行。这种过滤器可用来为响应添加标准的HTTP Header、收集统计信息和指标、将响应从微服务发送给客户端等。
(4) ERROR：在其他阶段发生错误时执行该过滤器
总结：通过一个个过滤器实现不同的业务逻辑，且不同过滤器类型按照顺序执行对应的业务
三，此文网关做了那几件事
1.PRE，前置需要处理的逻辑，跨域/XSS处理
2.POST，微服务处理之后记录处理时间等日志信息
具体处理逻辑
1.跨域问题重现，前端报错，如下包含了请求源Origin信息
2. ZuulFilter1跨域/xss攻击代码
Component
@RefreshScope
public class TimeCostPreFilter extends ZuulFilter {
public static final String START_TIME_KEY = "start_time";
public static final String ZUUL_REQUEST_URL_KEY = "zuul_request_start_time";
private static final Logger logger = LoggerFactory.getLogger(TimeCostPreFilter.class);
@Value("${com.gateway.xss.check:true}")
private Boolean xssCheck;
@Value("${com.gateway.xss.url.filter:uploadFile,uploadImage}")
private String urlFilter;
@Override
public String filterType() {
return FilterConstants.PRE_TYPE;
}
@Override
public int filterOrder() {
return 0;
}
/**
* 判断是否要拦截的逻辑
*/
@Override
public boolean shouldFilter() {
return true;
}
@Override
public Object run() {
long startTime = System.currentTimeMillis();
RequestContext currentContext = RequestContext.getCurrentContext();
HttpServletRequest request = currentContext.getRequest();
Enumeration<String> headerNames = request.getHeaderNames();
if (headerNames != null) {
while (headerNames.hasMoreElements()) {
String nextElement = headerNames.nextElement();
if (nextElement.equalsIgnoreCase("origin") && request.getHeader(nextElement) != null) {
String str = request.getHeader(nextElement).toLowerCase();
String pattern = "^(http|https)://(.*\\.skcloud\\.cn|.*\\.skcloud\\.com|.*\\.sk\\.com|localhost:?[0-9]*|api.rrx.cn|c2bt4.skcloud.com)$";
Pattern r = Pattern.compile(pattern);
Matcher m = r.matcher(str);
if (!m.matches()) {
return null;
}
}
}
}
StringBuffer requestUrl = request.getRequestURL();
String url = requestUrl.toString();
if (xssCheck) {
if (!StringUtils.isEmpty(urlFilter)) {
String[] urlFilterList = urlFilter.split(",");
for (String s : urlFilterList) {
if (!StringUtils.isEmpty(urlFilter) && url.contains(s)) {
currentContext.set(ZUUL_REQUEST_URL_KEY, url);
currentContext.set(START_TIME_KEY, startTime);
return null;
}
}
}
try {
Map<String, String[]> map = request.getParameterMap();
if (!(Objects.isNull(map) || map.isEmpty())) {
for (Map.Entry<String, String[]> entry : map.entrySet()) {
String[] value = entry.getValue();
if (extracted(currentContext, value[0])) {
return null;
}
}
}
InputStream in = request.getInputStream();
String body = StreamUtils.copyToString(in, StandardCharsets.UTF_8);
if (!StringUtils.isEmpty(body)) {
if (extracted(currentContext, body)) {
return null;
}
}
} catch (IOException e) {
e.printStackTrace();
}
}
currentContext.set(ZUUL_REQUEST_URL_KEY, url);
currentContext.set(START_TIME_KEY, startTime);
return null;
}
private static boolean extracted(RequestContext currentContext, String body) {
boolean b = checkXss(body);
if (b) {
currentContext.setSendZuulResponse(false);
currentContext.setResponseBody("非法请求");
currentContext.setResponseStatusCode(HttpStatus.BAD_REQUEST.value());
return true;
}
return false;
}
public static boolean checkXss(String str) {
if (StringUtils.isEmpty(str)) {
return false;
}
boolean contains = str.contains("<");
boolean contains1 = str.contains(">");
boolean onclick = str.contains("onclick");
return contains || contains1 || onclick;
}
3. ZuulFilter2，日志记录
@Component
@RefreshScope
public class TimeCostPostFilter extends ZuulFilter {
private static final String START_TIME_KE = "start_time";
public static final String ZUUL_REQUEST_URL_KEY = "zuul_request_start_time";
private static final Logger logger = LoggerFactory.getLogger(TimeCostPostFilter.class);
@Autowired
private GateWayRequestTimeClient gateWayRequestTimeClient;
@Override
public String filterType() {
return FilterConstants.POST_TYPE;
}
@Override
public int filterOrder() {
return 0;
}
@Override
public boolean shouldFilter() {
return true;
}
@Override
public Object run() {
RequestContext currentContext = RequestContext.getCurrentContext();
String requestUrl = (String) currentContext.get(ZUUL_REQUEST_URL_KEY);
long startTime = (long) currentContext.get(START_TIME_KE);
long endTime = System.currentTimeMillis();
long resultTime = endTime - startTime;
int responseStatusCode = currentContext.getResponseStatusCode();
gateWayRequestTimeClient.insertLog(startTime, endTime, resultTime, requestUrl, responseStatusCode);
return null;
}
}
