10.下载文件

通过编程进行文件下载，使你可以选择的将文件发送到浏览器，

通过编程发送资源到浏览器

1.隐藏资源

 1 package app12a.controller;
 2 
 3 import java.io.BufferedInputStream;
 4 import java.io.File;
 5 import java.io.FileInputStream;
 6 import java.io.IOException;
 7 import java.io.OutputStream;
 8 
 9 import javax.servlet.http.HttpServletRequest;
10 import javax.servlet.http.HttpServletResponse;
11 import javax.servlet.http.HttpSession;
12 
13 import org.apache.commons.logging.Log;
14 import org.apache.commons.logging.LogFactory;
15 import org.springframework.stereotype.Controller;
16 import org.springframework.ui.Model;
17 import org.springframework.web.bind.annotation.ModelAttribute;
18 import org.springframework.web.bind.annotation.RequestMapping;
19 
20 import app12a.domain.Login;
21 
22 @Controller
23 
24 public class ResourceController {
25     
26     private static final Log logger = LogFactory.getLog(ResourceController.class);
27     
28     @RequestMapping(value="/login")
29     public String login(@ModelAttribute Login login, HttpSession session, Model model) {
30         model.addAttribute("login", new Login());
31         if ("paul".equals(login.getUserName()) &&
32                 "secret".equals(login.getPassword())) {
33             session.setAttribute("loggedIn", Boolean.TRUE);
34             return "Main";
35         } else {
36             return "LoginForm";
37         }
38     }
39 
40     @RequestMapping(value="/resource_download")
41     public String downloadResource(HttpSession session, HttpServletRequest request,
42             HttpServletResponse response) {//1.添加httpServletResponse参数
43         if (session == null || 
44                 session.getAttribute("loggedIn") == null) {
45             return "LoginForm";
46         }
47         String dataDirectory = request.
48                 getServletContext().getRealPath("/WEB-INF/data");
49         File file = new File(dataDirectory, "secret.pdf");
50         if (file.exists()) { 
51             response.setContentType("application/pdf");//2.设置响应的内容类型设为文件内容类型
52             response.addHeader("Content-Disposition", //3.添加Content-Disposition响应标题
53                     "attachment; filename=secret.pdf");
54             byte[] buffer = new byte[1024];
55             FileInputStream fis = null;
56             BufferedInputStream bis = null;
57             // if using Java 7, use try-with-resources
58             try {
59                 fis = new FileInputStream(file);
60                 bis = new BufferedInputStream(fis);
61                 OutputStream os = response.getOutputStream();
62                 int i = bis.read(buffer);
63                 while (i != -1) {
64                     os.write(buffer, 0, i);
65                     i = bis.read(buffer);
66                 }
67             } catch (IOException ex) {
68                 // do something, 
69                 // probably forward to an Error page
70             } finally {
71                 if (bis != null) {
72                     try {
73                         bis.close();
74                     } catch (IOException e) {
75                     }
76                 }
77                 if (fis != null) {
78                     try {
79                         fis.close();
80                     } catch (IOException e) {
81                     }
82                 }
83             }
84         }
85         return null;
86     }
87     
88 }

secret.pdf文件放在WEB-INF/data目录下，因此不可能直接访问

只有得到授权才能访问,才能看到它

 1 <%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>
 2 <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
 3 <!DOCTYPE HTML>
 4 <html>
 5 <head>
 6 <title>Login</title>
 7 <style type="text/css">@import url("<c:url value="/css/main.css"/>");</style>
 8 </head>
 9 <body>
10 <div id="global">
11 <form:form commandName="login" action="login" method="post">
12     <fieldset>
13         <legend>Login</legend>
14         <p>
15             <label for="userName">User Name: </label>
16             <form:input id="userName" path="userName" cssErrorClass="error"/>
17         </p>
18         <p>
19             <label for="password">Password: </label>
20             <form:password id="password" path="password" cssErrorClass="error"/>
21         </p>
22         <p id="buttons">
23             <input id="reset" type="reset" tabindex="4">
24             <input id="submit" type="submit" tabindex="5" 
25                 value="Login">
26         </p>
27     </fieldset>
28 </form:form>
29 </div>
30 </body>
31 </html>

 1 <%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
 2 <!DOCTYPE HTML>
 3 <html>
 4 <head>
 5 <title>Download Page</title>
 6 <style type="text/css">@import url("<c:url value="/css/main.css"/>");</style>
 7 </head>
 8 <body>
 9 <div id="global">
10     <h4>Please click the link below.</h4>
11     <p>
12         <a href="resource_download">Download</a>
13     </p>
14 </div>
15 </body>
16 </html>

http://localhost:8080/app12a/login测试

2.防止交叉引用

为了防止通过交叉引用窃取你的网站资源

如果通过编程，使得只有当referer标题中包含你的域名时才发生资源，

就可以防止那种情况发生

 1 package app12a.controller;
 2 
 3 import java.io.BufferedInputStream;
 4 import java.io.File;
 5 import java.io.FileInputStream;
 6 import java.io.IOException;
 7 import java.io.OutputStream;
 8 
 9 import javax.servlet.http.HttpServletRequest;
10 import javax.servlet.http.HttpServletResponse;
11 
12 import org.apache.commons.logging.Log;
13 import org.apache.commons.logging.LogFactory;
14 import org.springframework.stereotype.Controller;
15 import org.springframework.web.bind.annotation.PathVariable;
16 import org.springframework.web.bind.annotation.RequestHeader;
17 import org.springframework.web.bind.annotation.RequestMapping;
18 import org.springframework.web.bind.annotation.RequestMethod;
19 
20 @Controller
21 public class ImageController {
22     
23     private static final Log logger = LogFactory.getLog(ImageController.class);
24     
25     @RequestMapping(value="/image_get/{id}", method = RequestMethod.GET)
26     public void getImage(@PathVariable String id, 
27             HttpServletRequest request, 
28             HttpServletResponse response, 
29             @RequestHeader String referer) {
30         if (referer != null) {
31             String imageDirectory = request.getServletContext().
32                     getRealPath("/WEB-INF/image");
33             File file = new File(imageDirectory, 
34                     id + ".jpg");
35             if (file.exists()) {
36                 response.setContentType("image/jpg");
37                 byte[] buffer = new byte[1024];
38                 FileInputStream fis = null;
39                 BufferedInputStream bis = null;
40                 // if you're using Java 7, use try-with-resources
41                 try {
42                     fis = new FileInputStream(file);
43                     bis = new BufferedInputStream(fis);
44                     OutputStream os = response.getOutputStream();
45                     int i = bis.read(buffer);
46                     while (i != -1) {
47                         os.write(buffer, 0, i);
48                         i = bis.read(buffer);
49                     }
50                 } catch (IOException ex) {
51                     // do something here
52                 } finally {
53                     if (bis != null) {
54                         try {
55                             bis.close();
56                         } catch (IOException e) {
57                             
58                         }
59                     }
60                     if (fis != null) {
61                         try {
62                             fis.close();
63                         } catch (IOException e) {
64                             
65                         }
66                     }
67                 }
68             }
69         }
70     }
71 }

 1 <!DOCTYPE HTML>
 2 <html>
 3 <head>
 4     <title>Photo Gallery</title>
 5 </head>
 6 <body>
 7 <img src="image_get/1"/>
 8 <img src="image_get/2"/>
 9 <img src="image_get/3"/>
10 <img src="image_get/4"/>
11 <img src="image_get/5"/>
12 <img src="image_get/6"/>
13 <img src="image_get/7"/>
14 <img src="image_get/8"/>
15 <img src="image_get/9"/>
16 <img src="image_get/10"/>
17 </body>
18 </html>

posted on 2016-03-28 22:32 Sharpest 阅读(296) 评论(0) 编辑收藏举报