使用 play 框架强制使用 Https 路由进行登录 [英] Enforce Https routing for login with play framework

问题描述

我只想为我的应用程序的登录页面强制执行 https 路由.

I want to enforce https routing for the login page only of my application.

Play 是否可以做到这一点！不使用前端 http 服务器?

Is it possible to do so with Play! without the use of a front end http server?

推荐答案

您可以使用 @Before 拦截器来重定向每个请求，即使用户直接键入 http://.下面是我使用的代码(它在运行无容器 play run 或在 Heroku 等前端运行时有效).

You can use an @Before interceptor to redirect every request, even if the user types http:// directly. Below is the code that I use (it works when running containerless play run, or when running behind a front end such as on Heroku).

public class HttpsRequired extends Controller {
    /** Called before every request to ensure that HTTPS is used. */
    @Before
    public static void redirectToHttps() {
        //if it's not secure, but Heroku has already done the SSL processing then it might actually be secure after all
        if (!request.secure && request.headers.get("x-forwarded-proto") != null) {
            request.secure = request.headers.get("x-forwarded-proto").values.contains("https");
        }

        //redirect if it's not secure
        if (!request.secure) {
            String url = redirectHostHttps() + request.url;
            System.out.println("Redirecting to secure: " + url);
            redirect(url);
        }
    }

    /** Renames the host to be https://, handles both Heroku and local testing. */
    @Util
    public static String redirectHostHttps() {
        if (Play.id.equals("dev")) {
            String[] pieces = request.host.split(":");
            String httpsPort = (String) Play.configuration.get("https.port");
            return "https://" + pieces[0] + ":" + httpsPort; 
        } else {
            if (request.host.endsWith("domain.com")) {
                return "https://secure.domain.com";
            } else {
                return "https://" + request.host;
            }
        }
    }    
}

这篇关于使用 play 框架强制使用 Https 路由进行登录的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！