从Jasperreports中的服务器接收多个不同的Content-Disposition标头

Question

我正在尝试在servlet的响应中设置content-disposition头,但我在浏览器中收到此错误.我该怎么办？

从服务器收到重复的标头

来自服务器的响应包含重复的标头.此问题通常是配置错误的网站或代理的结果.只有网站或代理管理员才能解决此问题.

错误349(net :: ERR_RESPONSE_HEADERS_MULTIPLE_CONTENT_DISPOSITION):收到多个不同的Content-Disposition标头.不允许这样做以防止HTTP响应分裂攻击.

这是我的servlet控制器:

@RequestMapping("/**/paymentOrderReport.pdf")
public class PaymentOrderReportViewController extends org.springframework.web.servlet.mvc.AbstractController {

    private PaymentDao paymentDao;
    private JasperPdfView pdfView;

    @Override
    protected ModelAndView handleRequestInternal(HttpServletRequest request, HttpServletResponse response) throws Exception {

        response.setContentType("application/pdf");
        response.setHeader("Content-disposition", "attachment; filename=" + "report.pdf");

        PaymentOrderEntity paymentOrderEntity = null;
        String traceCode = request.getParameter(ParamConstants.TRACE_CODE);

        if (traceCode != null) {
            PaymentSheetRequestEntity payRequestEntity = paymentDao.loadByUniqueProperty(PaymentSheetRequestEntity.PROP_TRACE_CODE,
                    traceCode);
            if (payRequestEntity != null) {
                paymentOrderEntity = payRequestEntity.getPaymentOrder();
            }
        }

        if (paymentOrderEntity != null) {
            List<PaymentOrderEntity> result = new ArrayList<PaymentOrderEntity>();
            result.add(paymentOrderEntity);
            JRDataSource jrDataSource = new JRBeanCollectionDataSource(result);

            Map<String, Object> model = new HashMap<String, Object>();
            model.put("reportData", jrDataSource);

            return new ModelAndView(pdfView, model);
        }
        return null;
    }

    public void setPaymentDao(PaymentDao paymentDao) {
        this.paymentDao = paymentDao;
    }

    public void setPdfView(JasperPdfView pdfView) {
        this.pdfView = pdfView;
    }
}

和JasperPdfView类:

public class JasperPdfView extends AbstractJasperReportsView {

    @Override
    protected void renderReport(JasperPrint populatedReport, Map<String, Object> model, HttpServletResponse response) throws Exception {
        JRPdfExporter jrPdfExporter = new JRPdfExporter();
        if (getConvertedExporterParameters() != null) {
            jrPdfExporter.setParameters(getConvertedExporterParameters());
        }
        jrPdfExporter.setParameter(JRExporterParameter.JASPER_PRINT, populatedReport);
        jrPdfExporter.setParameter(JRExporterParameter.OUTPUT_STREAM, response.getOutputStream());
        jrPdfExporter.exportReport();
    }

}

Answer 1

如果您要下载文件名中包含逗号的文件,Google Chrome可能会显示此错误消息.你真的只使用"report.pdf"作为文件名吗？

阅读HTTP规范后,Content-Disposition标头(不是HTTP规范本身的一部分)不应包含逗号字符,因为它将被视为两个不同标头的分隔符.

当且仅当该头字段的整个字段值被定义为以逗号分隔的列表[即,#(值)]时,具有相同字段名的多个消息头字段可以存在于消息中.必须可以将多个头字段组合成一个"字段名:字段 - 值"对,而不改变消息的语义,方法是将每个后续字段值附加到第一个字段值,每个字段值用逗号分隔.

因此,如果您的文件名是报告,May2014.pdf然后Chrome解释

Content-Disposition: attachment; filename=report,May2014.pdf

作为同一http消息头的两个值

Content-Disposition: attachment; filename=report

Content-Disposition: May2014.pdf

反过来又被解释为HTTP响应分裂攻击,可能是因为在单个HTTP响应中实际上不存在多个Content-Disposition头值.

其他浏览器似乎不介意文件名中的逗号.