XSS与CSRF攻击防御概念

先看这两篇文章：XSS攻击原理及防御措施

      CSRF攻击介绍及防御

攻击概念

防御

具体做法

@Overridepublic boolean PReHandle(HttpServletRequest request, HttpServletResponse response, Object handler){	String referer = request.getHeader("Referer");	if(!WebUtils.valideCSRFAddress(referer)) {		logger.error("=================referer===============" + referer);		return false;	}}
public static String[] domainList= { "app.bank.example.com", "data.bank.example.com", "oss.bank.example.com", "bank.example.com", "www.hiifit.com", "www.hiifit.net" };public static boolean valideCSRFAddress(String referer) {	if(StringUtils.isEmpty(referer)) {		return false;	}	if (referer.contains("?")) {	    referer = referer.substring(0, referer.indexOf("?"));	}	URI referUri = null;	try {	    referUri = new URI(referer);	} catch (Exception e) {		e.printStackTrace();	    return false;	}	String domain = referUri.getHost().toLowerCase();	for (int i = 0; i < domainList.length; i++) {	    if (domainList[i].toLowerCase().equals(domain)) {		return true;	    }	}	return false;}