Question

如何设置安全的header

Answer 1

首先，我们先看一下http的头信息到底是什么：
HTTP（HyperTextTransferProtocol） 即超文本传输协议，目前网页传输的的通用协议。HTTP协议采用了请求/响应模型，浏览器或其他客户端发出请求，服务器给与响应。就整个网络资源传输而 言，包括message-header和message-body两部分。首先传递message- header，即http header消息。http header 消息通常被分为4个部分： general header, request header, response header, entity header。但是这种分法就理解而言，感觉界限不太明确，根据日常使用，大体分为Request和Response两部分。
在通常的servlet/jsp应用中，我们只是从http的header中取得信息，如果要设置信息，需要用到HttpClient，具体的设置方法如下：
HttpResponse response = null;
HttpGet get = new HttpGet(url);
get.addHeader("Accept", "text/html");
get.addHeader("Accept-Charset", "utf-8");
get.addHeader("Accept-Encoding", "gzip");
get.addHeader("Accept-Language", "en-US,en");
get.addHeader("User-Agent", "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.160 Safari/537.22");
response = client.execute(get);
HttpEntity entity = response.getEntity();
Header header = entity.getContentEncoding();
if (header != null)
{
HeaderElement[] codecs = header.getElements();
for (int i = 0; i < codecs.length; i++)
{
if (codecs[i].getName().equalsIgnoreCase("gzip"))
{
response.setEntity(new GzipDecompressingEntity(entity));
}
}
}
return response;
其中，client为一个HttpClient的实力，创建方式如：
SchemeRegistry schemeRegistry = new SchemeRegistry();
schemeRegistry.register(new Scheme("http", 80, PlainSocketFactory.getSocketFactory()));
schemeRegistry.register(new Scheme("https", 443, SSLSocketFactory.getSocketFactory()));
PoolingClientConnectionManager cm = new PoolingClientConnectionManager(schemeRegistry);
cm.setMaxTotal(200);
cm.setDefaultMaxPerRoute(2);
HttpHost googleResearch = new HttpHost("research.google.com", 80);
HttpHost wikipediaEn = new HttpHost("en.wikipedia.org", 80);
cm.setMaxPerRoute(new HttpRoute(googleResearch), 30);
cm.setMaxPerRoute(new HttpRoute(wikipediaEn), 50);
DefaultHttpClient client = new DefaultHttpClient(cm);