SpringCloud 中防止绕过网关请求直接访问后端服务的解决方法

@Component
@Order(0)
public class GatewayRequestFilter implements GlobalFilter {
    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        byte[] token = Base64Utils.encode((CloudConstant.GATEWAY_TOKEN_VALUE).getBytes());
        String[] headerValues = {new String(token)};
        ServerHttpRequest build = exchange.getRequest()
                .mutate()
                .header(CloudConstant.GATEWAY_TOKEN_HEADER, headerValues)
                .build();
        ServerWebExchange newExchange = exchange.mutate().request(build).build();
        return chain.filter(newExchange);
    }
}

@Data
@ConfigurationProperties(prefix = "javadaily.cloud")
public class CloudSecurityProperties {
    /**
     * 是否只能通过网关获取资源
     * 默认为True
     */
    private Boolean onlyFetchByGateway = Boolean.TRUE;
}

public class ServerProtectInterceptor implements HandlerInterceptor {
    private CloudSecurityProperties properties;
    @Override
    public boolean preHandle(@NonNull HttpServletRequest request, @NonNull HttpServletResponse response, @NonNull Object handler){
        if (!properties.getOnlyFetchByGateway()) {
            return true;
        }
        String token = request.getHeader(CloudConstant.GATEWAY_TOKEN_HEADER);
        String gatewayToken = new String(Base64Utils.encode(CloudConstant.GATEWAY_TOKEN_VALUE.getBytes()));
        if (StringUtils.equals(gatewayToken, token)) {
            return true;
        } else {
            ResultData<String> resultData = new ResultData<>();
            resultData.setSuccess(false);
            resultData.setStatus(HttpServletResponse.SC_FORBIDDEN);
            resultData.setMessage("请通过网关访问资源");
            WebUtils.writeJson(response,resultData);
            return false;
        }
    }
    public void setProperties(CloudSecurityProperties properties) {
        this.properties = properties;
    }
}

public class CloudSecurityInterceptorConfigure implements WebMvcConfigurer {
    private CloudSecurityProperties properties;
    @Autowired
    public void setProperties(CloudSecurityProperties properties) {
        this.properties = properties;
    }
    @Bean
    public HandlerInterceptor serverProtectInterceptor() {
        ServerProtectInterceptor interceptor = new ServerProtectInterceptor();
        interceptor.setProperties(properties);
        return interceptor;
    }
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(serverProtectInterceptor());
    }
}

@EnableConfigurationProperties(CloudSecurityProperties.class)
public class CloudSecurityAutoConfigure{
    @Bean
    public CloudSecurityInterceptorConfigure cloudSecurityInterceptorConfigure() {
        return new CloudSecurityInterceptorConfigure();
    }
}

org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
   com.javadaily.component.security.configure.CloudSecurityAutoConfigure

javadaily:
  cloud:
    onlyFetchByGateway: true

<dependency>
	<groupId>com.jianzh5.cloud</groupId>
	<artifactId>cloud-component-security-starter</artifactId>
</dependency>