我正在尝试禁用 JBOSS HTTP OPTIONS 方法。在 JBoss 的 web.xml 中使用以下语法,我可以禁用除 OPTIONS 之外的所有 http 方法。有没有办法成功禁用 http-method OPTIONS?
<security-constraint>
<web-resource-collection>
<web-resource-name>Restricted</web-resource-name>
<description>Declarative security tests</description>
<url-pattern>/EVE/*</url-pattern>
<http-method>PUT</http-method>
<http-method>DELETE</http-method>
<http-method>OPTIONS</http-method>
<http-method>TRACE</http-method>
</web-resource-collection>
<auth-constraint>
<description>Only authenticated users can access secure content</description>
<role-name>AuthorizedUser</role-name>
</auth-constraint>
<user-data-constraint>
<description>no description</description>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint> <security-constraint>
<web-resource-collection>
<web-resource-name>Restricted 2</web-resource-name>
<description>Declarative security tests</description>
<url-pattern>/*</url-pattern>
<http-method>PUT</http-method>
<http-method>DELETE</http-method>
<http-method>OPTIONS</http-method>
<http-method>TRACE</http-method>
</web-resource-collection>
<auth-constraint>
<description>Only authenticated users can access secure content</description>
<role-name>AuthorizedUser</role-name>
</auth-constraint>
<user-data-constraint>
<description>no description</description>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
最佳答案
选项 1 - 使用 RewriteValve(可以全局应用)
您可以使用 RewriteValve 来禁用 http 方法。看看documentation .您将需要一个 RewriteCond 指令和一个 RewriteRule。
在您的 RewriteCond 指令中,您可以使用 REQUEST_METHOD 服务器变量指定所有方法,例如:
RewriteCond %{REQUEST_METHOD} ^(PUT|DELETE|TRACE|OPTIONS)$ [NC]
然后您的 RewriteRule 可以将它们标记为禁止(它会立即发回 403 (FORBIDDEN) 的 HTTP 响应),例如:
RewriteRule .* - [F]
如果是 Jboss EAP 6
<subsystem xmlns="urn:jboss:domain:web:1.1" default-virtual-server="default-host" native="false">
<connector name="http" protocol="HTTP/1.1" scheme="http" socket-binding="http"/>
<virtual-server name="default-host" enable-welcome-root="true">
<rewrite pattern=".*" substitution="-" flags="F">
<condition test="%{REQUEST_METHOD}" pattern="^(PUT|DELETE|TRACE|OPTIONS)$" flags="NC" />
</rewrite>
</virtual-server>
</subsystem>
除了上面回答中所说的之外,它还可以通过 web.xml 来完成。
检查上面的用法
curl -v -X TRACE http://hostname:port/appContext
curl -v -X DELETE http://hostname:port/appContex
关于java - 如何在 JBoss 中禁用 HTTP OPTIONS 方法?,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/41035666/