高风险-危险的HTTP请求类型

//Restrict all method except GET & POST Spring boot
@Configuration
public class TomcatCustomizer implements EmbeddedServletContainerCustomizer {
          
   

    @Override
    public void customize(ConfigurableEmbeddedServletContainer container) {
          
   
        TomcatEmbeddedServletContainerFactory tomcat = (TomcatEmbeddedServletContainerFactory) container;
        tomcat.setSessionTimeout(8, TimeUnit.HOURS);
        tomcat.addContextCustomizers(new ContextSecurityCustomizer());

    }
    private static class ContextSecurityCustomizer implements TomcatContextCustomizer {
          
   
        @Override
        public void customize(Context context) {
          
   
            SecurityConstraint constraint = new SecurityConstraint();
            SecurityCollection securityCollection = new SecurityCollection();
            securityCollection.setName("restricted_methods");
            securityCollection.addPattern("/*");
            securityCollection.addOmittedMethod(HttpMethod.POST.toString());
            securityCollection.addOmittedMethod(HttpMethod.GET.toString());
            constraint.addCollection(securityCollection);
            constraint.setAuthConstraint(true);
            context.addConstraint(constraint);
        }
    }

}

但是这个类可能是很早的时候写的，有些方法已经过时或者被替换了，于是我改为如下：

package com.test.config;

import org.apache.catalina.Context;
import org.apache.tomcat.util.descriptor.web.SecurityCollection;
import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
import org.springframework.boot.web.embedded.tomcat.TomcatContextCustomizer;
import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
import org.springframework.boot.web.server.WebServerFactory;
import org.springframework.boot.web.server.WebServerFactoryCustomizer;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
//Restrict all method except GET & POST Spring boot
@Configuration
public class TomcatConfiguration implements WebServerFactoryCustomizer {
          
   
    @Override
    public void customize(WebServerFactory factory) {
          
   
        TomcatServletWebServerFactory  tomcat = (TomcatServletWebServerFactory ) factory;
        tomcat.addContextCustomizers(new ContextSecurityCustomizer());
    }

    private static class ContextSecurityCustomizer implements TomcatContextCustomizer {
          
   
        @Override
        public void customize(Context context) {
          
   
            SecurityConstraint constraint = new SecurityConstraint();
            SecurityCollection securityCollection = new SecurityCollection();
            securityCollection.setName("restricted_methods");
            securityCollection.addPattern("/*");
            securityCollection.addOmittedMethod(HttpMethod.POST.toString());
            securityCollection.addOmittedMethod(HttpMethod.GET.toString());
            constraint.addCollection(securityCollection);
            constraint.setAuthConstraint(true);
            context.addConstraint(constraint);
        }
    }
}

大概意思就是说把除了get，post的其他http方法都禁掉，如果用PUT等除了GET,POST请求访问的话是报403，重启即解决问题。