DispatcherServlet으로 공통로직 작성

[Spring] DispatcherServlet을 통해서 다른페이지에 접속하도록 코드 작성해보기

Jan 25, 2024

Contents

1. 보안에 취약 2. 강제성 부여

Spring에서 FrontController는 DispatcherServlet이라고 함.

공통로직을 작성하여 DispatcherServlet을 통한다음 다른 페이지에 접속하도록 코드 작성

1. 보안에 취약

DispatcherServlet


package com.example.userapp.conpig;

import jakarta.servlet.ServletException;
import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

import java.io.IOException;

// FrontController
@WebServlet("*.do")
public class DispatcherServlet extends HttpServlet {
    @Override
    protected void service(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        // 1. 공통로직
        System.out.println("common logic~~");
        resp.setHeader("Content-Type", "text/html; charset=utf-8");

        // 2. 분기
        String uri = req.getRequestURI();
        System.out.println(uri);

        if(uri.equals("/join-form.do")){
            resp.sendRedirect("/user/join-form.jsp");
        } else if (uri.equals("/join.do")) {
            resp.sendRedirect("/user/join.jsp");
        } else if (uri.equals("/main.do")) {
            resp.sendRedirect("/board/main.jsp");
        } else {
            resp.setStatus(404);
            resp.getWriter().println("잘못된 페이지를 입력하셨습니다.");
        }

    }
}

main.jsp


<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
<h1>main page</h1>
<hr>
</body>
</html>

join.jsp


<%@ page contentType="text/html;charset=UTF-8" language="java" %>

<%
    response.setHeader("Content-Type", "text/html; charset=utf-8"); // 한글 처리

    // 1. 파싱
    String username = request.getParameter("username");
    String password = request.getParameter("password");
    String email = request.getParameter("email");
    System.out.println("username : " + username);
    System.out.println("password : " + password);
    System.out.println("email : " + email);

    // 2. 유효성 검사 (1000줄 됨)
    if (username.length() < 3 || username.length() > 10) {
        response.getWriter().println("<h1>username 글자수가 3~10여야 합니다.</h1>");
        return;
    }
        response.setStatus(302);
        response.setHeader("Location","/board/main.jsp");
        response.setHeader("clock","/12pm");

%>

join-form.jsp


<%@ page import="java.time.LocalDateTime" %>
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<%
    LocalDateTime now = LocalDateTime.now();
%>

<html>
<head>
    <title>Title</title>
</head>
<body>
<h1>회원가입 페이지 <%=now%></h1>

<hr>
<form action="/WEB-INF/user/join.jsp" method="">
    <input type="text" placeholder="username" name="username">
    <input type="text" placeholder="password" name="password">
    <input type="text" placeholder="email" name="email">
    <button>회원가입</button>
</form>
</body>
</html>

외부에서 접근이 가능해서 DispatcherServlet을 거치지않고도 접속이 가능 /join-form.do를 입력해서 들어가야 하는데 /user/join-form.jsp 이걸로 바로 접속이가능함(강제성을 부여해줘야함)

2. 강제성 부여

내부적으로 요청하여 보안폴더(WEB-INF)에 접근이 가능하게 코드 작성

DispatcherServlet


package com.example.userapp.conpig;

import jakarta.servlet.ServletException;
import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

import java.io.IOException;

// FrontController
@WebServlet("*.do")
public class DispatcherServlet extends HttpServlet {
    @Override
    protected void service(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        // 1. 공통로직
        System.out.println("common logic~~");
        resp.setHeader("Content-Type", "text/html; charset=utf-8");

        // 2. 분기
        String uri = req.getRequestURI();
        System.out.println(uri);

        if(uri.equals("/join-form.do")){
            //resp.sendRedirect("/WEB-INF/user/join-form.jsp");
            req.getRequestDispatcher("/WEB-INF/user/join-form.jsp").forward(req,resp);
        } else if (uri.equals("/join.do")) {
            //resp.sendRedirect("/WEB-INF/user/join.jsp");
            req.getRequestDispatcher("/WEB-INF/user/join.jsp").forward(req,resp);
        } else if (uri.equals("/main.do")) {
            //resp.sendRedirect("/WEB-INF/board/main.jsp");
            req.getRequestDispatcher("/WEB-INF/board/main.jsp").forward(req,resp);
        } else {
            resp.setStatus(404);
            resp.getWriter().println("잘못된 페이지를 입력하셨습니다.");
        }

    }
}

main.jsp


<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
<h1>main page</h1>
<hr>
</body>
</html>

join.jsp


<%@ page contentType="text/html;charset=UTF-8" language="java" %>

<%
    response.setHeader("Content-Type", "text/html; charset=utf-8"); // 한글 처리

    // 1. 파싱
    String username = request.getParameter("username");
    String password = request.getParameter("password");
    String email = request.getParameter("email");
    System.out.println("username : " + username);
    System.out.println("password : " + password);
    System.out.println("email : " + email);

    // 2. 유효성 검사 (1000줄 됨)
    if (username.length() < 3 || username.length() > 10) {
        response.getWriter().println("<h1>username 글자수가 3~10여야 합니다.</h1>");
        return;
    }
        response.setStatus(302);
        response.setHeader("Location","/main.do");
        response.setHeader("clock","/12pm");

%>

join-form.jsp


<%@ page import="java.time.LocalDateTime" %>
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<%
    LocalDateTime now = LocalDateTime.now();
%>

<html>
<head>
    <title>Title</title>
</head>
<body>
<h1>회원가입 페이지 <%=now%></h1>

<hr>
<form action="/join.do" method="post">
    <input type="text" placeholder="username" name="username">
    <input type="text" placeholder="password" name="password">
    <input type="text" placeholder="email" name="email">
    <button>회원가입</button>
</form>
</body>
</html>