JAVA

首先介紹下CXF的攔截器:
簡單地說，CXF使用流水線型(或者說總線型)處理機制，它的核心是一個Bus。一個客戶端的請求或者一個對客戶端樁代碼的調(diào)用被組織成為一個Message。同時，所有的CXF功能都組織成Interceptor掛接在Bus上，分階段依次處理Message。Message本質(zhì)上是一個Map數(shù)據(jù)結(jié)構(gòu)，既包含系統(tǒng)公共的也包含Interceptor自定義的數(shù)據(jù)。

AbstractPhaseInterceptor<Message>這個抽象類攔截器類,自定義攔截器類可以繼承它實現(xiàn)它其中一個抽象方法public void handleMessage(Message message) throws Fault

如下代碼實現(xiàn):

package com.jd.train.service.webservice.ipinterceptor;

import com.jd.train.service.util.CodesUtil;
import org.apache.cxf.interceptor.Fault;
import org.apache.cxf.message.Message;
import org.apache.cxf.phase.AbstractPhaseInterceptor;
import org.apache.cxf.phase.Phase;
import org.apache.cxf.transport.http.AbstractHTTPDestination;
import org.apache.log4j.LogManager;
import org.apache.log4j.Logger;

import javax.servlet.http.HttpServletRequest;
import java.util.List;

/**
 * Created by IntelliJ IDEA.
 * User: zhangzhaozhao
 * Date: 12-3-26
 * Time: 下午4:06
 * To change this template use File | Settings | File Templates.
 */
public class IpAddressInInterceptor extends AbstractPhaseInterceptor<Message> {
    //這個屬性是注入進來的,你也可以從properties,xml文件中去讀取,也可以從數(shù)據(jù)庫中去獲取;
    private List<String> ipList;

    public void setIpList(List<String> ipList) {
        this.ipList = ipList;
    }

    private final static Logger logger = LogManager.getLogger(IpAddressInInterceptor.class);
    public IpAddressInInterceptor() {
        super(Phase.RECEIVE);
    }

    public void handleMessage(Message message) throws Fault {
        //指定CXF獲取客戶端的HttpServletRequest : http-request；
        HttpServletRequest request = (HttpServletRequest) message.get(AbstractHTTPDestination.HTTP_REQUEST);
        String ipAddress="";
        boolean flag = false;
        if (null != request) {
            ipAddress = getUserIpAddr(request); // 取客戶端IP地址
            logger.info("請求客戶端的IP地址:" + ipAddress);
            for (String s : ipList) {
                if (s.equals(ipAddress)) {
                    flag = true;
                    break;
                }
            }
        }
        if(!flag) {
            throw new Fault(new IllegalAccessException("IP address " + ipAddress + " is stint"));
        }
    }

    /**
     * 獲取IP地址的方法
     * @param request
     * @return
     */
    private String getUserIpAddr(HttpServletRequest request) {
        //獲取經(jīng)過代理的客戶端的IP地址; 排除了request.getRemoteAddr() 方法 在通過了Apache,Squid等反向代理軟件就不能獲取到客戶端的真實IP地址了
        String ip = CodesUtil.getIpAddr(request);
        if (ip != null && ip.indexOf(",") > 0) {
            logger.info("取到客戶多個ip1====================" + ip);
            String[] arr = ip.split(",");
            ip = arr[arr.length - 1].trim();//有多個ip時取最后一個ip
            logger.info("取到客戶多個ip2====================" + ip);
        }
        return ip;
    }
}

看下Spring 配置文件的信息:

<beans xmlns="       xmlns:xsi="       xmlns:jaxws="       xmlns:http-conf="http://www.springframework.org/schema/beans
             http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
             http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd
             http://cxf.apache.org/transports/http/configuration
             http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/core        default-autowire="byName">

    <import resource="classpath:META-INF/cxf/cxf.xml"/>
    <import resource="classpath:META-INF/cxf/cxf-extension-soap.xml"/>
    <import resource="classpath:META-INF/cxf/cxf-servlet.xml"/>

    <jaxws:endpoint id="messageNotifyServices" address="/MessageNotifyServices" >
        <jaxws:implementor>
            <bean class="com.jd.train.service.webservice.impl.MessageNotifyServicesImpl"/>
        </jaxws:implementor>
        <jaxws:inInterceptors>
            <ref bean="ipInterceptor"/>
        </jaxws:inInterceptors>
    </jaxws:endpoint>
    <!-- 訂單推送WebService接口-->
    <jaxws:endpoint id="orderStatusServices" address="/OrderStatusServices">
        <!--這是需要發(fā)布的實現(xiàn)類 -->
        <jaxws:implementor>
            <bean class="com.jd.train.service.webservice.impl.OrderStatusServicesImpl"/>
        </jaxws:implementor>
        <jaxws:inInterceptors>
            <ref bean="ipInterceptor"/>
        </jaxws:inInterceptors>
    </jaxws:endpoint>

    <!--毫秒單位 name 為 webservice 的域名 或者地址-->
    <http-conf:conduit name="${train.api.domain.name}.*">
        <http-conf:client ConnectionTimeout="10000" ReceiveTimeout="20000"/>
    </http-conf:conduit>

    <bean id="logIn" class="org.apache.cxf.interceptor.LoggingInInterceptor"/>
    <bean id="logOut" class="org.apache.cxf.interceptor.LoggingOutInterceptor"/>
     <!-- 自定義攔截器-->
    <bean id="ipInterceptor" class="com.jd.train.service.webservice.ipinterceptor.IpAddressInInterceptor"/>
    <!-- 合法的IP地址,如果第三方IP變動需要修改 -->
    <bean id="ipList" class="java.util.ArrayList">
        <constructor-arg>
            <list>
                <value>114.80.202.120</value>
            </list>
        </constructor-arg>
    </bean>

    <!-- CXF 全局的攔截器-->
   <cxf:bus>
       <cxf:inInterceptors>
           <ref bean="logIn"/>
       </cxf:inInterceptors>
       <cxf:outInterceptors>
           <ref bean="logOut" />
       </cxf:outInterceptors>
   </cxf:bus>

   
</beans>

解釋下里面東西:
<jaxws:endpoint id="messageNotifyServices" address="/MessageNotifyServices" >
<jaxws:implementor>
    <bean class="com.jd.train.service.webservice.impl.MessageNotifyServicesImpl"/>
</jaxws:implementor>
<jaxws:inInterceptors>
    <ref bean="ipInterceptor"/>
</jaxws:inInterceptors>
</jaxws:endpoint>

<!-- 訂單推送WebService接口-->
<jaxws:endpoint id="orderStatusServices" address="/OrderStatusServices">
<!--這是需要發(fā)布的實現(xiàn)類 -->
<jaxws:implementor>
    <bean class="com.jd.train.service.webservice.impl.OrderStatusServicesImpl"/>
</jaxws:implementor>
<jaxws:inInterceptors>
    <ref bean="ipInterceptor"/>
</jaxws:inInterceptors>
</jaxws:endpoint>
這兩個是我發(fā)布出去的WebService 接口(這里需要你自己去實現(xiàn),我并沒有把代碼貼出來);
<jaxws:inInterceptors>
    <ref bean="ipInterceptor"/>
</jaxws:inInterceptors> 這個是自定義的攔截器類

說到這里需要注意下了:如果把自定義的攔截器引入到發(fā)布出去的接口當中,而不是引入到全局的<cxf:bus>中,這樣只對你發(fā)布出去的接口起作用
如果配置到全局的<cxf:bus>中對你訪問第三方的WebService接口和別人訪問你發(fā)布出去的WebService接口,都起到攔截作用,我開發(fā)過程遇到此問題,我調(diào)用第三方的webService接口時候也被攔截了,其中在自定義攔截器的HttpServletRequest request = (HttpServletRequest) message.get(AbstractHTTPDestination.HTTP_REQUEST);
request是null ,并且IP也被過過濾掉了,使其我不能訪問第三方的接口了.

第二個問題:就是Spring 配置文件的頭信息http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd搞進去!

第三個問題:就是在獲取客戶IP時候,request.getRemoteAddr()取得客戶端的IP地址,但是在通過了Apache,Squid等反向代理軟件就不能獲取到客戶端的真實IP地址了。
經(jīng)過代理以后，由于在客戶端和服務(wù)之間增加了中間層，因此服務(wù)器無法直接拿到客戶端的IP，服務(wù)器端應(yīng)用也無法直接通過轉(zhuǎn)發(fā)請求的地址返回給客戶端。但是在轉(zhuǎn)發(fā)請求的HTTP頭信息中，增加了X－FORWARDED－FOR信息用以跟蹤原有的客戶端IP地址和原來客戶端請求的服務(wù)器地址。
給出比較靠譜實現(xiàn):
 public static String getIpAddr(HttpServletRequest request) {
        String ip = request.getHeader("x-forwarded-for");
        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("Proxy-Client-IP");
        }
        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("WL-Proxy-Client-IP");
        }
        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getRemoteAddr();
        }
        return ip;
    }
如果通過了多級反向代理的話，X-Forwarded-For的值并不止一個，而是一串ip值，其中哪個才是真正的用戶端的真實IP呢？
答案是取X-Forwarded-For中第一個非unknown的有效IP字符串。如：X-Forwarded-For：192.168.1.110, 192.168.1.120, 192.168.1.130, 192.168.1.100,用戶真實IP為： 192.168.1.110
如果朋友遇到以上問題,請多加注意.