java httpinvoker漏洞_Spring HttpInvoker 服务端安全验证的和客户端请求配置

1、服务端

服务Java接口

package service;

public interface TestService {

int add(int i,int j);

}

服务的Java实现

package service.impl;

import org.springframework.stereotype.Service;

import service.TestService;

@Service("testService")

public class TestServiceImpl implements TestService {

@Override

public int add(int i, int j) {

System.out.println("Add method Invoked! " + i + "+" + j + "=?");

return i+j;

}

}

Tomcat的tomcat-users.xml

WEB-INF/web.xml

xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">

Spring2.5Study_Remote

contextConfigLocation

classpath:applicationContext.xml,classpath:org/codehaus/xfire/spring/xfire.xml

org.springframework.web.context.ContextLoaderListener

remoting

org.springframework.web.servlet.DispatcherServlet

1

remoting

*.rpc

Remoting Protect

/remoting/*

remoting

BASIC

Tomcat Supported Realm

An role defined in "conf/tomcat-users.xml"

remoting

index.html

index.htm

index.jsp

WEB-INF/remoting-servlet.xml

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context"

xsi:schemaLocation="http://www.springframework.org/schema/beans

http://www.springframework.org/schema/beans/spring-beans-2.5.xsd

http://www.springframework.org/schema/context

http://www.springframework.org/schema/context/spring-context-2.5.xsd">

2、客户端请求

URI uri = new URI(serviceUrl);

CommonsHttpInvokerRequestExecutor executor = new CommonsHttpInvokerRequestExecutor();

HttpClient client = executor.getHttpClient();

HttpClientParams params = client.getParams();

params.setConnectionManagerTimeout(300000); //??

params.setSoTimeout(300000); //??

params.setAuthenticationPreemptive(true);       //抢先认证

client.getState().setCredentials(new AuthScope(uri.getHost(),uri.getPort()),new UsernamePasswordCredentials(username,password));

HttpInvokerProxyFactoryBean factoryBean = new HttpInvokerProxyFactoryBean();

factoryBean.setServiceInterface(serviceInterface);

factoryBean.setServiceUrl(serviceUrl);

factoryBean.setHttpInvokerRequestExecutor(executor);

factoryBean.afterPropertiesSet();

return factoryBean.getObject();