Spring boot 内置tomcat禁止不安全HTTP方法

古城微笑少年丶 2022-06-07 08:41 221阅读 0赞

1、在tomcat的web.xml中可以配置如下内容，让tomcat禁止不安全的HTTP方法

<security-constraint>  
       <web-resource-collection>  
          <url-pattern>/*</url-pattern>  
          <http-method>PUT</http-method>  
    	  <http-method>DELETE</http-method>  
    	  <http-method>HEAD</http-method>  
    	  <http-method>OPTIONS</http-method>  
    	  <http-method>TRACE</http-method>  
       </web-resource-collection>  
       <auth-constraint>  
       </auth-constraint>  
    </security-constraint>  
    <login-config>  
      <auth-method>BASIC</auth-method>  
    </login-config>

2、Spring boot使用内置tomcat，没有web.xml配置文件，可以通过以下配置进行，简单来说就是要注入到Spring容器中

@Configuration
    public class TomcatConfig {
    
        @Bean
        public EmbeddedServletContainerFactory servletContainer() {
            TomcatEmbeddedServletContainerFactory tomcatServletContainerFactory = new TomcatEmbeddedServletContainerFactory();
            tomcatServletContainerFactory.addContextCustomizers(new TomcatContextCustomizer(){
    
    			@Override
    			public void customize(Context context) {
    				SecurityConstraint constraint = new SecurityConstraint();
    				SecurityCollection collection = new SecurityCollection();
    				//http方法
    				collection.addMethod("PUT");
    				collection.addMethod("DELETE");
    				collection.addMethod("HEAD");
    				collection.addMethod("OPTIONS");
    				collection.addMethod("TRACE");
    				//url匹配表达式
    				collection.addPattern("/*");
    				constraint.addCollection(collection);
    				constraint.setAuthConstraint(true);
    				context.addConstraint(constraint );
    				
    				//设置使用httpOnly
    				context.setUseHttpOnly(true);
    				
    			}
            });
            return tomcatServletContainerFactory;
        }
    
    }