security - Spring MVC : how to require POST parameters in the request body and ignore query string parameters?

Question

我有一个提供身份验证 Web 服务的简单 Controller 。它接受用户名和密码作为 POST 参数并返回 JSON 结果。因为正在提交密码，所以我不想鼓励任何人在查询字符串上提交密码。我想强制要求它只在请求正文中被接受。这将确保发布值的 ssl 加密。我如何在 Sping MVC 中完成它？

@RequestMapping(value = "/authenticate", method = RequestMethod.POST)
    public ResponseEntity<String> handleAuthenticateGet(
            @RequestParam(value = PRAConstants.USERNAME) String username,
            @RequestParam(value = PRAConstants.PASSWORD) String password)
    {
        boolean authSuccess = LDAPUtil.authenticateUser(username, password);
        HttpHeaders responseHeaders = new HttpHeaders();
        responseHeaders.setContentType(MediaType.APPLICATION_JSON);
        return new ResponseEntity<String>("{\"result\":" + authSuccess + "}", responseHeaders, HttpStatus.OK);
    }
}

Answer 1

Per Lee Meador，我添加了这个:

boolean authSuccess = false;
// if password is passed on the query string, then always return false. otherwise, go ahead and check with ldap
if ( !StringUtils.contains(request.getQueryString(), PRAConstants.PASSWORD) )
{
    authSuccess = LDAPUtil.authenticateUser(username, password);
}

这对我有用...