使用spring boot在undertow中禁用http TRACK/TRACE

Posted 2023-02-27

【中文标题】使用spring boot在undertow中禁用http TRACK/TRACE

【英文标题】：Disable http TRACK/TRACE in undertow using spring boot

【发布时间】：2018-01-02 08:10:50

【问题描述】：

我想在 undertow 中禁用 http TRACE。我正在使用 spring boot，默认情况下会提供 undertow。我已经排除了tomcat并使用undertow。我在其他 *** 帖子 (here) 中得到了 tomcat 的答案，但我无法为 undertow 找到相同的答案。这是我到目前为止所做的。

    @Bean
    public EmbeddedServletContainerCustomizer containerCustomizer() 
        return new EmbeddedServletContainerCustomizer() 
            @Override
            public void customize(ConfigurableEmbeddedServletContainer container) 
                if (container.getClass().isAssignableFrom(UndertowEmbeddedServletContainerFactory.class)) 
                    UndertowEmbeddedServletContainerFactory underTowContainer = (UndertowEmbeddedServletContainerFactory) container;
                    underTowContainer.addDeploymentInfoCustomizers(new ContextSecurityCustomizer());
                
            
        ;
    

    private static class ContextSecurityCustomizer implements UndertowDeploymentInfoCustomizer 
        @Override
        public void customize(DeploymentInfo deploymentInfo) 
            DeploymentInfo info = new DeploymentInfo();
            // What next after this
        
    

请帮我完成这段代码。我是否朝着正确的方向前进？提前致谢

【参考方案1】：

你可以使用undertow的DisallowedMethodsHandler：

import io.undertow.server.handlers.DisallowedMethodsHandler;

@Component
public class UndertowWebServerCustomizer
        implements WebServerFactoryCustomizer<UndertowServletWebServerFactory> 

    @Override
    public void customize(UndertowServletWebServerFactory factory) 

        factory.addDeploymentInfoCustomizers(deploymentInfo -> 
            deploymentInfo.addInitialHandlerChainWrapper(new HandlerWrapper() 
                @Override
                public HttpHandler wrap(HttpHandler handler) 
                    HttpString[] disallowedHttpMethods =  HttpString.tryFromString("TRACE"),
                        HttpString.tryFromString("TRACK") ;
                    return new DisallowedMethodsHandler(handler, disallowedHttpMethods);
                
            );
        );
    

【参考方案2】：

这应该适用于undertow：

@Bean
    public EmbeddedServletContainerCustomizer containerCustomizer() 
        return new EmbeddedServletContainerCustomizer() 
            @Override
            public void customize(ConfigurableEmbeddedServletContainer container) 
                if (container.getClass().isAssignableFrom(UndertowEmbeddedServletContainerFactory.class)) 
                    UndertowEmbeddedServletContainerFactory undertowContainer = (UndertowEmbeddedServletContainerFactory) container;
                    undertowContainer.addDeploymentInfoCustomizers(new ContextSecurityCustomizer());
                
            
        ;
    

    private static class ContextSecurityCustomizer implements UndertowDeploymentInfoCustomizer 

        @Override
        public void customize(io.undertow.servlet.api.DeploymentInfo deploymentInfo) 
            SecurityConstraint constraint = new SecurityConstraint();
            WebResourceCollection traceWebresource = new WebResourceCollection();
            traceWebresource.addUrlPattern("/*");
            traceWebresource.addHttpMethod(HttpMethod.TRACE.toString());
            constraint.addWebResourceCollection(traceWebresource);
            deploymentInfo.addSecurityConstraint(constraint);