老大给了一个很实际的需求：有段程序，使用Http的方式与合作商交互，而且是明文传输数据。我方的代码已经打包放在服务器上运行了很长时间，这时合作商突然要求修改数据传输的方式，要求加密后再传输，而我方的原有的代码不能改变，以防止引发其它问题。 

问：如何在不修改我方现有的代码的前提下，满足合作商的要求？ 

可能大家都想到了，只要加上一个过滤器Filter不就可以了吗？事实就是这样的，采用Filter+HttpServletRequestWrapper就可以解决这个问题。 

首先：在filter中拦截到加密后的请求，将参数解密，然后组装成一个新的明文请求串。 

然后：重写HttpServletRequestWrapper中的getInputStream()方法，让其返回过滤器解析后的明文串即可。 

具体代码解释如下。 

首先我写了两个一摸一样的servlet，一个用来直接接收合作商的明文请求并打印；一个用来接收Filter处理后的合作商的请求并打印（Filter中将合作商加密后的参数解密再传给这个Servlet）。

@WebServlet("/SiServlet")
public class SiServlet extends HttpServlet {
    private static final long serialVersionUID = 1L;

    /**
     * @see HttpServlet#HttpServlet()
     */
    public SiServlet() {
        super();
    }

    /**
     * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse
     *      response)
     */
    protected void doGet(HttpServletRequest request,
            HttpServletResponse response) throws ServletException, IOException {
        this.doPost(request, response);
    }

    /**
     * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse
     *      response)
     *
     */
    protected void doPost(HttpServletRequest request,
            HttpServletResponse response) throws ServletException, IOException {
        String bizBindMsg = IOUtils.toString(request.getInputStream(), "UTF-8");
        bizBindMsg = URLDecoder.decode(bizBindMsg.toString(), "UTF-8");
        System.out.println("SiServlet接收到请求为: " + bizBindMsg);

        response.getWriter().write("==========success=========");
    }
}

@WebServlet("/SiServletNormal")
public class SiServletNormal extends HttpServlet {
    private static final long serialVersionUID = 1L;

    /**
     * @see HttpServlet#HttpServlet()
     */
    public SiServletNormal() {
        super();
    }

    /**
     * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse
     *      response)
     */
    protected void doGet(HttpServletRequest request,
            HttpServletResponse response) throws ServletException, IOException {
        this.doPost(request, response);
    }

    /**
     * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse
     *      response)
     *
     */
    protected void doPost(HttpServletRequest request,
            HttpServletResponse response) throws ServletException, IOException {
        String bizBindMsg = IOUtils.toString(request.getInputStream(), "UTF-8");
        bizBindMsg = URLDecoder.decode(bizBindMsg.toString(), "UTF-8");
        System.out.println("SiServletNormal接收到请求为: " + bizBindMsg);

        response.getWriter()
                .write("==========SiServletNormal Success=========");
    }
}

然后我使用HttpClient模拟了一下合作商发送明文和密文请求的过程，加密使用Base64简单模拟一下。 

public class AdcClient {
    private HttpPost httpPost = null;
    private HttpClient client = null;
    private List<NameValuePair> pairs = null;

    public AdcClient() {
        httpPost = new HttpPost("http://localhost:8080/filtertest/SiServlet");
        client = new DefaultHttpClient();
    }

    /**
     * 发送明文消息
     *
     */
    public void sendMsg() {

        try {
            httpPost = new HttpPost(
                    "http://localhost:8080/filtertest/SiServletNormal");

            pairs = new ArrayList<NameValuePair>();
            pairs.add(new BasicNameValuePair(("param1"), "obama没加密"));
            pairs.add(new BasicNameValuePair(("param2"), "男没加密"));
            pairs.add(new BasicNameValuePair(("param3"), "汉没加密"));
            pairs.add(new BasicNameValuePair(("param4"), "山东没加密"));

            httpPost.setEntity(new UrlEncodedFormEntity(pairs, "UTF-8"));
            // httpPost.setHeader("Cookie", "TOKEN=1234567890");
            HttpResponse response = client.execute(httpPost);

            HttpEntity entity = response.getEntity();
            BufferedReader br = new BufferedReader(new InputStreamReader(
                    entity.getContent()));
            String line = null;
            StringBuffer result = new StringBuffer();
            while ((line = br.readLine()) != null) {
                result.append(line);
                line = br.readLine();
            }

            System.out.println("来自SiServletNormal的响应为:" + result.toString());
        } catch (UnsupportedEncodingException e) {
            e.printStackTrace();
        } catch (ClientProtocolException e) {
            e.printStackTrace();
        } catch (IOException e) {
            e.printStackTrace();
        }
    }

    /**
     * 发送加密后的消息
     */
    public void sendEncryptMsg() {
        try {
            pairs = new ArrayList<NameValuePair>();
            pairs.add(new BasicNameValuePair(("param1"), Base64EnDecrypt
                    .base64Encode("obama")));
            pairs.add(new BasicNameValuePair(("param2"), Base64EnDecrypt
                    .base64Encode("男")));
            pairs.add(new BasicNameValuePair(("param3"), Base64EnDecrypt
                    .base64Encode("汉")));
            pairs.add(new BasicNameValuePair(("param4"), Base64EnDecrypt
                    .base64Encode("山东")));

            HttpEntity reqEntity = new UrlEncodedFormEntity(pairs, "UTF-8");
            httpPost.setEntity(reqEntity);
            // httpPost.setHeader("Cookie", "TOKEN=1234567890");
            HttpResponse response = client.execute(httpPost);

            /**
             * 获取响应信息
             */
            HttpEntity entity = response.getEntity();
            BufferedReader br = new BufferedReader(new InputStreamReader(
                    entity.getContent()));
            String line = null;
            StringBuffer result = new StringBuffer();
            while ((line = br.readLine()) != null) {
                result.append(line);
                line = br.readLine();
            }

            System.out.println("来自SiServlet的响应为:" + result.toString());
        } catch (UnsupportedEncodingException e) {
            e.printStackTrace();
        } catch (ClientProtocolException e) {
            e.printStackTrace();
        } catch (IOException e) {
            e.printStackTrace();
        }
    }

    /**
     * @param args
     * @throws UnsupportedEncodingException
     */
    public static void main(String[] args) throws UnsupportedEncodingException {
        new AdcClient().sendMsg();

        new AdcClient().sendEncryptMsg();
    }
}

重点是下面的这个HttpServletRequestWrapper，我重写了它的getInputStream()方法，这个方法返回包含明文的ServletInputStream

public class MyRequestWrapper extends HttpServletRequestWrapper {
    private HttpServletRequest request;

    public MyRequestWrapper(HttpServletRequest request) {
        super(request);
        this.request = request;
    }

    /**
     * 先解密，获取明文；然后将明文转化为字节数组；然后再去读取字节数组中的内容
     */
    @Override
    public ServletInputStream getInputStream() {
        String bizBindMsg = null;
        ServletInputStream stream = null;

        try {
            stream = request.getInputStream();
            bizBindMsg = IOUtils.toString(stream, "UTF-8");
        } catch (IOException e) {
            e.printStackTrace();
        }
        try {
            bizBindMsg = URLDecoder.decode(bizBindMsg.toString(), "UTF-8");
        } catch (UnsupportedEncodingException e) {
            e.printStackTrace();
        }
        System.out.println("MyRequestWrapper接收到的请求为: " + bizBindMsg);

        /**
         * 获取加密的值进行解密
         */
        final StringBuffer reqStr = new StringBuffer();
        reqStr.append("param1=").append(
                Base64EnDecrypt.base64Decode(bizBindMsg.substring(
                        bizBindMsg.indexOf("param1=") + 7,
                        bizBindMsg.indexOf("param2="))));
        reqStr.append("&");
        reqStr.append("param2=").append(
                Base64EnDecrypt.base64Decode(bizBindMsg.substring(
                        bizBindMsg.indexOf("param2=") + 7,
                        bizBindMsg.indexOf("param3="))));
        reqStr.append("&");
        reqStr.append("param3=").append(
                Base64EnDecrypt.base64Decode(bizBindMsg.substring(
                        bizBindMsg.indexOf("param3=") + 7,
                        bizBindMsg.indexOf("param4="))));
        reqStr.append("&");
        reqStr.append("param4=").append(
                Base64EnDecrypt.base64Decode(bizBindMsg.substring(bizBindMsg
                        .indexOf("param4=") + 7)));

        System.out.println("********MyRequestWrapper接收到的解密后的请求为*********");
        System.out.println(reqStr.toString());

        /**
         * 将解密后的明文串放到buffer数组中
         */
        byte[] buffer = null;
        try {
            buffer = reqStr.toString().getBytes("UTF-8");
        } catch (UnsupportedEncodingException e) {
            e.printStackTrace();
        }
        final ByteArrayInputStream bais = new ByteArrayInputStream(buffer);

        ServletInputStream newStream = new ServletInputStream() {

            @Override
            public int read() throws IOException {
                return bais.read();
            }
        };
        return newStream;
    }
}

最后是简单的Filter，在这里将加密后的ServletRequest重新包装，交给SiServlet进行处理

public class EncryptFilter implements Filter {

    @Override
    public void destroy() {
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException {

        chain.doFilter(new MyRequestWrapper((HttpServletRequest) request),
                response);
    }

    @Override
    public void init(FilterConfig arg0) throws ServletException {

    }

}

我的web.xml中是这样配置的 

<filter>
    <filter-name>encryptFilter</filter-name>
    <filter-class>com.test.filter.EncryptFilter</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>encryptFilter</filter-name>
    <url-pattern>/SiServlet</url-pattern>
  </filter-mapping>

确保过滤器entyptFilter只拦截到SiServlet的请求即可。 

运行AdcClient，可以看到下面的结果 

这里的重点是MyRequestWrapper中重写的getInputStream()方法。大家可以看看API中关于HttpServletRequest的用法。

 

http://lichuanbao.iteye.com/blog/1102138