一文吃透：若依框架静态资源防盗链从原理到代码

package com.ruoyi.framework.filter;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Arrays;
import java.util.List;
/**
 * 若依框架 防盗链过滤器
 * 核心：校验Referer头，只允许白名单域名访问静态资源
 */
@Component
public class RefererFilter extends OncePerRequestFilter {
    /**
     * 防盗链白名单（配置在application.yml中，多个域名用逗号分隔）
     * 示例：ruoyi.com,localhost:8080,127.0.0.1:8080
     */
    @Value("${ruoyi.antiHotlink.allowReferer:}")
    private String allowReferer;
    /**
     * 需要拦截的资源后缀（静态资源）
     */
    private static final List<String> INTERCEPT_SUFFIX = Arrays.asList(".jpg", ".png", ".gif", ".mp4", ".pdf", ".docx");
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
        // 1. 获取请求URL，判断是否为需要拦截的静态资源
        String requestURI = request.getRequestURI().toLowerCase();
        boolean isIntercept = INTERCEPT_SUFFIX.stream().anyMatch(requestURI::endsWith);
        if (!isIntercept) {
            // 非静态资源，直接放行
            filterChain.doFilter(request, response);
            return;
        }
        // 2. 解析白名单
        List<String> allowList = Arrays.asList(allowReferer.split(","));
        if (allowList.isEmpty()) {
            // 白名单为空，直接放行（或根据需求返回403）
            filterChain.doFilter(request, response);
            return;
        }
        // 3. 获取Referer头
        String referer = request.getHeader("Referer");
        if (referer == null || referer.isEmpty()) {
            // 无Referer请求（直接访问资源URL），可配置为放行/拒绝
            // 此处示例：拒绝无Referer的请求
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            response.getWriter().write("403 Forbidden: 非法访问（无Referer）");
            return;
        }
        // 4. 校验Referer是否在白名单内
        boolean isAllow = allowList.stream().anyMatch(referer::contains);
        if (isAllow) {
            // 合法来源，放行
            filterChain.doFilter(request, response);
        } else {
            // 非法来源，返回403
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            response.getWriter().write("403 Forbidden: 非法访问（防盗链拦截）");
        }
    }
}

ruoyi:
  # 防盗链配置
  antiHotlink:
    # 允许的Referer白名单（多个域名用逗号分隔）
    allowReferer: "ruoyi.com,localhost:8080,127.0.0.1:8080,192.168.1.0/24"

package com.ruoyi.framework.config;
import com.ruoyi.framework.filter.RefererFilter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
/**
 * 过滤器注册配置
 */
@Configuration
public class FilterConfig {
    @Autowired
    private RefererFilter refererFilter;
    /**
     * 注册防盗链过滤器
     */
    @Bean
    public FilterRegistrationBean<RefererFilter> refererFilterRegistration() {
        FilterRegistrationBean<RefererFilter> registration = new FilterRegistrationBean<>();
        registration.setFilter(refererFilter);
        // 拦截所有请求（后续在过滤器内筛选静态资源）
        registration.addUrlPatterns("/*");
        // 过滤器名称
        registration.setName("refererFilter");
        // 执行顺序（数字越小，执行越早）
        registration.setOrder(1);
        return registration;
    }
}

@Component
public class GatewayRefererFilter implements GlobalFilter, Ordered {
    @Value("${ruoyi.antiHotlink.allowReferer:}")
    private String allowReferer;
    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        ServerHttpRequest request = exchange.getRequest();
        String requestURI = request.getPath().value().toLowerCase();
        // 1. 校验资源类型（同单体版）
        // 2. 获取Referer（网关层获取请求头的方式）
        String referer = request.getHeaders().getFirst("Referer");
        // 3. 白名单校验（逻辑同单体版）
        // 4. 放行/拒绝（网关层拒绝请求的方式）
        if (!isAllow) {
            ServerHttpResponse response = exchange.getResponse();
            response.setStatusCode(HttpStatus.FORBIDDEN);
            return response.setComplete();
        }
        return chain.filter(exchange);
    }
    @Override
    public int getOrder() {
        return 1; // 执行顺序
    }
}