DWR配置记录

近日闲来无聊，研究DWR，配置了半天终于搞定，遇到的问题记录一下，呵呵
开发环境：NetBeans6.5/Jdk1.6.10/Tomcat5.5.27/Dwr2.0.5
我的web.xml文件配置如下：

<servlet>
        <servlet-name>dwr-invoker</servlet-name>
        <servlet-class>org.directwebremoting.servlet.DwrServlet</servlet-class>
        <init-param>
            <param-name>debug</param-name>
            <param-value>true</param-value>
        </init-param>
        <!--crossDomainSessionSecurity:设置成false能够从其他域进行请求-->
        <init-param>
            <param-name>crossDomainSessionSecurity</param-name>
            <param-value>false</param-value>
        </init-param>
        <init-param>
            <param-name>allowScriptTagRemoting</param-name>
            <param-value>true</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
        <servlet-name>dwr-invoker</servlet-name>
        <url-pattern>/dwr/*</url-pattern>
</servlet-mapping>

dwr.xml文件如下：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE dwr PUBLIC "-//GetAhead Limited//DTD Direct Web Remoting 2.0//EN" "http://getahead.org/dwr/dwr20.dtd">
<dwr>
    <allow>
        <create creator="new" javascript="dwrService">
            <param name="class" value="com.ffms.system.web.DWRService"/>
        </create>
    </allow>
</dwr>

页面部分代码如下：

<script type='text/javascript' src='/FFMS/dwr/interface/dwrService.js'></script>

  //输入到方法中 参数 格式转换
  function objectEval(text){
    text = text.replace(/\n/g, ' ');
    text = text.replace(/\r/g, ' ');
    if (text.match(/^\s*\{.*\}\s*$/))
    {
      text = '[' + text + '][0]';
    }
    return eval(text);
  }
  //本例 alert 展现
  var reply = function(data){
      alert("ssss");
      alert(dwr.util.toDescriptiveString(data, 2));
  }

<html:password styleId="newPwd" property="newPwd" name="SmOperMngForm" maxlength="6" onchange="dwrService.checkPassword(objectEval($('newPwd').value), reply);"/>

java类源码如下：

package com.ffms.system.web;

/**
 * 采用dwr框架进行动态ajax验证
 * @author MalColm Mao
 */
public class DWRService {
    public String checkPassword(String pwd){
        System.out.println("pssswork is ok:" + pwd);
        return "dwr success";
    }
}

主要遇到两个问题：
（1）A request has been denied as a potential CSRF attack
解决该问题在web.xml中如上述设置crossDomainSessionSecurity为false即可
（2）allowScriptTagRemoting is false
解决该问题在web.xml中如上述设置allowScriptTagRemoting为true即可

评论

2 楼 yuanyuan7891 2015-02-11  

crossDomainSessionSecurity为false降低了安全性，可能会有CSRF attack 的风险。

1 楼 marswdl 2009-03-02  

兄台水平不错，很好，很强大！

我的QQ：87265817