欢迎来到Doc100.Net免费学习资源知识分享平台!
您的位置:首页 > 程序异常 >

web 安全性有关问题

更新时间: 2014-01-05 00:50:45 责任编辑: Author_N1

 

web 安全性问题
添加过滤器,将没有用都的请求方法过滤掉,如DELETE

import java.io.IOException;
import java.util.Arrays;
import java.util.List;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class RequestFilter implements Filter {

	public void init(FilterConfig config) throws ServletException {

	}

	public void destroy() {

	}

	public void doFilter(ServletRequest request, ServletResponse response,
			FilterChain chain) throws IOException, ServletException {
		HttpServletRequest req = (HttpServletRequest) request;
		HttpServletResponse res = (HttpServletResponse) response;
		String method = req.getMethod();
		List<String> methodList = Arrays.asList("DELETE", "HEAD", "PUT",
				"OPTIONS","TRACE");
		if (methodList.contains(method)) {
			res.setStatus(403);
			return;
		}
		chain.doFilter(request, response);
	}
}


也可以在web.xml中设置

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
	xsi:schemaLocation=" http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
	id="WebApp_ID" version="2.5">


	<security-constraint>
		<web-resource-collection>
			<url-pattern>/*</url-pattern>
			<http-method>PUT</http-method>
			<http-method>DELETE</http-method>
			<http-method>HEAD</http-method>
			<http-method>OPTIONS</http-method>
			<http-method>TRACE</http-method>
		</web-resource-collection>
		<auth-constraint>
		</auth-constraint>
	</security-constraint>
	<login-config>
		<auth-method>BASIC</auth-method>
	</login-config>

</web-app>



这种方式,用内嵌的jetty启动会报错,但tomcat没问题。。。未解决。。。暂时使用filter



Cookie中设置httpOnly标识
web.xml
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
	xsi:schemaLocation=" http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
	id="WebApp_ID" version="2.5">


	<session-config>
		<cookie-config>
			<http-only>true</http-only>
		</cookie-config>
	</session-config>

</web-app>

也可以在 代码中设置
cookie.setHttpOnly(true);




上一篇:上一篇
下一篇:下一篇

 

随机推荐程序问答结果

 

 

如对文章有任何疑问请提交到问题反馈,或者您对内容不满意,请您反馈给我们DOC100.NET论坛发贴求解。
DOC100.NET资源网,机器学习分类整理更新日期::2014-01-05 00:50:45
如需转载,请注明文章出处和来源网址:http://www.doc100.net/bugs/t/479/
本文WWW.DOC100.NET DOC100.NET版权所有。