如何禁用Spring Boot内置Undertow的HTTP TRACE/TRACK

一时失言乱红尘 2022-12-06 01:27 169阅读 0赞

### 文章目录 ###

*  如何禁用Spring Boot内置Undertow的HTTP TRACE/TRACK
 *   *  前言
     *  测试应用是否允许HTTP TRACE
     *  禁用Spring Boot内置的Undertow的HTTP TRACE/TRACK
     *  参考文档

# 如何禁用Spring Boot内置Undertow的HTTP TRACE/TRACK #

## 前言 ##

因为安全原因，需要禁用Spring Boot内置Web服务器的HTTP TRACE/TRACK方法。

*  Spring Boot版本：`spring-boot:2.2.2.RELEASE`
 *  内置Web服务器：Undertow

## 测试应用是否允许HTTP TRACE ##

curl -v -X TRACE http://<ip>:<port>

如果应用允许HTTP TRACE，响应信息为`200 OK`。

如果应用不允许HTTP TRACE，响应信息为`405 Method Not Allowed`。

## 禁用Spring Boot内置的Undertow的HTTP TRACE/TRACK ##

在`autoconfigure`包下，创建一个配置类`UndertowWebServerCustomizerConfig`，禁用HTTP TRACE/TRACK方法。

示例代码：

package com.example.demo.autoconfigure;
    
    import io.undertow.server.HandlerWrapper;
    import io.undertow.server.HttpHandler;
    import io.undertow.server.handlers.DisallowedMethodsHandler;
    import io.undertow.util.HttpString;
    import org.springframework.boot.web.embedded.undertow.UndertowServletWebServerFactory;
    import org.springframework.boot.web.server.WebServerFactoryCustomizer;
    import org.springframework.context.annotation.Configuration;
    
    
    @Configuration
    public class UndertowWebServerCustomizerConfig implements WebServerFactoryCustomizer<UndertowServletWebServerFactory> { 
    
        @Override
        public void customize(UndertowServletWebServerFactory factory) { 
            factory.addDeploymentInfoCustomizers(deploymentInfo -> { 
                deploymentInfo.addInitialHandlerChainWrapper(new HandlerWrapper() { 
                    @Override
                    public HttpHandler wrap(HttpHandler handler) { 
                        HttpString[] disallowedHttpMethods = { HttpString.tryFromString("TRACE"),
                                HttpString.tryFromString("TRACK")};
                        return new DisallowedMethodsHandler(handler, disallowedHttpMethods);
                    }
                });
            });
        }
    }

在`resources/META-INF/spring.factories`中设置自动配置类。

org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
    com.example.demo.autoconfigure.UndertowWebServerCustomizerConfig

关于Spring Boot `autoconfigure`参见：

*  [Create a Custom Auto-Configuration with Spring Boot][]

> 如果使用`@Component`注解，而不是`autoconfigure`的做法，需要确保Spring Boot Application启动时Component Scan会包含该类所在的包路径，否则设置不会生效。

## 参考文档 ##

*  [https://stackoverflow.com/questions/45336518/disable-http-track-trace-in-undertow-using-spring-boot][https_stackoverflow.com_questions_45336518_disable-http-track-trace-in-undertow-using-spring-boot]
 *  [How to disable Trace/Track in Apache/httpd][How to disable Trace_Track in Apache_httpd]
 *  [Container Configuration in Spring Boot 2][]

[Create a Custom Auto-Configuration with Spring Boot]: https://www.baeldung.com/spring-boot-custom-auto-configuration#:~:text=Create%20a%20Custom%20Auto-Configuration%20with%20Spring%20Boot%201,Creating%20a%20Custom%20Auto-Configuration.%20...%20More%20items...%20
[https_stackoverflow.com_questions_45336518_disable-http-track-trace-in-undertow-using-spring-boot]: https://stackoverflow.com/questions/45336518/disable-http-track-trace-in-undertow-using-spring-boot
[How to disable Trace_Track in Apache_httpd]: https://www.linuxcnf.com/2017/08/how-to-disable-tracetrack-in-apachehttpd.html
[Container Configuration in Spring Boot 2]: https://www.baeldung.com/embeddedservletcontainercustomizer-configurableembeddedservletcontainer-spring-boot