spring-boot 禁用 HTTP 方法 [英] spring-boot disable HTTP methods

问题描述

对于 Tomcat，禁用某些 HTTP 方法相当容易.只需添加到 web.xml:

For Tomcat it's fairly easy to disable certain HTTP methods. Just add to the web.xml:

    <security-constraint>
    <web-resource-collection>
        <web-resource-name>restricted methods</web-resource-name>
        <url-pattern>/*</url-pattern>
        <http-method>PUT</http-method>
        <http-method>DELETE</http-method>
        <http-method>HEAD</http-method>
        <http-method>OPTIONS</http-method>
        <http-method>TRACE</http-method>
    </web-resource-collection>
    <auth-constraint/>
</security-constraint>

我如何在 spring-boot 中做同样的事情?
我尝试添加以下内容:

How do I do the same in spring-boot?
I've tried adding the following:

@Bean
public EmbeddedServletContainerCustomizer containerCustomizer() {
    return new EmbeddedServletContainerCustomizer() {
        @Override
        public void customize(ConfigurableEmbeddedServletContainer container) {
            if (container.getClass().isAssignableFrom(TomcatEmbeddedServletContainerFactory.class)) {
                TomcatEmbeddedServletContainerFactory tomcatContainer = (TomcatEmbeddedServletContainerFactory) container;
                tomcatContainer.addContextCustomizers(new ContextSecurityCustomizer());
            }
        }
    };
}

private static class ContextSecurityCustomizer implements TomcatContextCustomizer {
    @Override
    public void customize(Context context) {
        SecurityConstraint constraint = new SecurityConstraint();
        SecurityCollection securityCollection = new SecurityCollection();
        securityCollection.setName("restricted_methods");
        securityCollection.addPattern("/*");
        securityCollection.addMethod(HttpMethod.DELETE.toString());
        constraint.addCollection(securityCollection);
        context.addConstraint(constraint);
    }
}

收效甚微.EmbeddedServletContainerCustomizer bean 已创建，但我仍然可以发出 DELETE 请求.
有任何想法吗?

with little success. The EmbeddedServletContainerCustomizer bean is created, however I can still issue DELETE requests.
Any ideas ?

推荐答案

//Restrict all method except GET & POST Spring boot
@Configuration
public class TomcatCustomizer implements EmbeddedServletContainerCustomizer {

    @Override
    public void customize(ConfigurableEmbeddedServletContainer container) {
        TomcatEmbeddedServletContainerFactory tomcat = (TomcatEmbeddedServletContainerFactory) container;
        tomcat.setSessionTimeout(8, TimeUnit.HOURS);
        tomcat.addContextCustomizers(new ContextSecurityCustomizer());

    }
    private static class ContextSecurityCustomizer implements TomcatContextCustomizer {
        @Override
        public void customize(Context context) {
            SecurityConstraint constraint = new SecurityConstraint();
            SecurityCollection securityCollection = new SecurityCollection();
            securityCollection.setName("restricted_methods");
            securityCollection.addPattern("/*");
            securityCollection.addOmittedMethod(HttpMethod.POST.toString());
            securityCollection.addOmittedMethod(HttpMethod.GET.toString());
            constraint.addCollection(securityCollection);
            constraint.setAuthConstraint(true);
            context.addConstraint(constraint);
        }
    }

}

这篇关于spring-boot 禁用 HTTP 方法的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！