HTTP --- 基础禁用PUT、DELETE、TRACE等方法

最新推荐文章于 2024-05-28 19:44:41 发布

原创最新推荐文章于 2024-05-28 19:44:41 发布 · 7.6k 阅读

12 ·

CC 4.0 BY-SA版权

文章标签：

#http

HTTP协议专栏收录该内容

5 篇文章

订阅专栏

博客围绕HTTP服务展开，重点介绍了禁用PUT、DELETE、TRACE等危险方法。具体说明了在tomcat中可通过在应用程序的web.xml添加代码实现，还提及了jetty禁用相关方法的两种方式，包括基于xml配置和springboot 2.X项目中使用jetty容器的情况。

HTTP — 基础禁用PUT、DELETE、TRACE等方法

HTTP 服务

在httpd.conf中增加，只允许GET、POST、OPTIONS方法

<Location "/"> AllowMethods GET POST OPTIONS </Location>

重启apache

systemctl restart httpd.service

tomcat 禁用PUT、DELETE、TRACE等危险方法

在应用程序的web.xml中添加如下的代码即可：

<security-constraint>    
	<web-resource-collection>    
		<url-pattern>/*</url-pattern>    
		<http-method>PUT</http-method>    
		<http-method>DELETE</http-method>    
		<http-method>OPTIONS</http-method>    
		<http-method>TRACE</http-method>    
	</web-resource-collection>    
	<auth-constraint>    
	</auth-constraint>    
</security-constraint>    
<login-config>    
	<auth-method>BASIC</auth-method>    
</login-config>

jetty禁用http put和delete等方法的方式

1. 基于xml的配置方式

<security-constraint>
<display-name>Example Security Constraint</display-name>
<web-resource-collection>
<web-resource-name>Protected Area</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>DELETE</http-method>
<http-method>HEAD</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<auth-constraint>
</auth-constraint>
</security-constraint>

2. springboot项目，容器是jetty,版本 springboot 2.X


```java
@Bean
public JettyServletWebServerFactory createJettyServletWebServerFactory() {
return new JettyServletWebServerFactory(){
@Override
protected void postProcessWebAppContext(WebAppContext webAppContext) {

HttpConstraintElement disable = new HttpConstraintElement(ServletSecurity.EmptyRoleSemantic.DENY);
HttpMethodConstraintElement put = new HttpMethodConstraintElement("PUT", disable);
HttpMethodConstraintElement delete = new HttpMethodConstraintElement("DELETE", disable);
HttpMethodConstraintElement head = new HttpMethodConstraintElement("HEAD", disable);


ServletSecurityElement sse = new ServletSecurityElement(Arrays.asList(put, delete, head));
List<ConstraintMapping> mappings = ConstraintSecurityHandler.createConstraintsWithMappingsForPath("disable", "/*", sse);

ConstraintSecurityHandler csh = new ConstraintSecurityHandler();
csh.setConstraintMappings(mappings);
webAppContext.setSecurityHandler(csh);
}
};
}


*备注：不允许的情况下访问就会报告 http 403 forbidden 错误。*