Question

我正在尝试禁用JBOSS HTTP OPTIONS方法。在JBoss的web.xml中使用以下语法，我可以禁用除OPTIONS之外的所有http方法。有没有办法成功禁用http-method OPTIONS？

<security-constraint>  
<web-resource-collection>  
    <web-resource-name>Restricted</web-resource-name>  
    <description>Declarative security tests</description>  
    <url-pattern>/EVE/*</url-pattern>       
    <http-method>PUT</http-method>  
    <http-method>DELETE</http-method>
    <http-method>OPTIONS</http-method>
    <http-method>TRACE</http-method>    
</web-resource-collection>  
<auth-constraint>  
    <description>Only authenticated users can access secure content</description>  
    <role-name>AuthorizedUser</role-name>  
</auth-constraint>  
<user-data-constraint>  
    <description>no description</description>  
    <transport-guarantee>NONE</transport-guarantee>  
</user-data-constraint>  
</security-constraint>  <security-constraint>  
<web-resource-collection>  
    <web-resource-name>Restricted 2</web-resource-name>  
    <description>Declarative security tests</description>  
    <url-pattern>/*</url-pattern>        
    <http-method>PUT</http-method>  
    <http-method>DELETE</http-method> 
    <http-method>OPTIONS</http-method>
    <http-method>TRACE</http-method>  
</web-resource-collection>  
<auth-constraint>  
    <description>Only authenticated users can access secure content</description>  
    <role-name>AuthorizedUser</role-name>  
</auth-constraint>  
<user-data-constraint>  
    <description>no description</description>  
    <transport-guarantee>NONE</transport-guarantee>  
</user-data-constraint>  
</security-constraint>

Answer 1

选项1 - 使用RewriteValve（可以全局应用）

您可以使用RewriteValve来禁用http方法。看看documentation。您将需要一个RewriteCond指令和一个RewriteRule。

在RewriteCond指令中，您可以使用REQUEST_METHOD服务器变量指定所有方法，例如：

RewriteCond %{REQUEST_METHOD} ^(PUT|DELETE|TRACE|OPTIONS)$ [NC]

然后你的RewriteRule可以将它们标记为禁止（它会立即发回403响应（FORBIDDEN）），例如：

RewriteRule .* - [F]

对于Jboss EAP 6

<subsystem xmlns="urn:jboss:domain:web:1.1" default-virtual-server="default-host" native="false">
    <connector name="http" protocol="HTTP/1.1" scheme="http" socket-binding="http"/>
    <virtual-server name="default-host" enable-welcome-root="true">
        <rewrite pattern=".*" substitution="-" flags="F">
            <condition test="%{REQUEST_METHOD}" pattern="^(PUT|DELETE|TRACE|OPTIONS)$" flags="NC" />
    </rewrite>
    </virtual-server>
</subsystem>

除此之外，如上所述，可以通过web.xml完成每个战争。

要检查以上用途

curl -v -X TRACE http://hostname:port/appContext
curl -v -X DELETE http://hostname:port/appContex

Answer 2

我建议使用mod_rewrite。它更清洁。

Answer 3

here are the following ways to limit HTTP methods in a web application:

1. Adding security constraints in web.xml

<security-constraint>
    <web-resource-collection>
        <web-resource-name>NoAccess</web-resource-name>
        <url-pattern>/*</url-pattern>
          <http-method>DELETE</http-method>
          <http-method>TRACE</http-method>
          <http-method>OPTIONS</http-method>
    </web-resource-collection>
    <auth-constraint/>
</security-constraint>

Here DELETE, TRACE and OPTIONS are restricted for all urls. curl -kvv -X DELETE <url> will give 403 Forbidden

2. Using Rewrite rules in domain.xml 

<subsystem xmlns="urn:jboss:domain:web:1.1" default-virtual-server="default-host" native="false">
    <connector name="http" protocol="HTTP/1.1" scheme="http" socket-binding="http"/>
    <virtual-server name="default-host" enable-welcome-root="true">
        <rewrite pattern=".*" substitution="-" flags="F">
            <condition test="%{REQUEST_METHOD}" pattern="^(DELETE|TRACE|OPTIONS)$" flags="NC" />
    </rewrite>
    </virtual-server>
</subsystem>

3. Using mod_rewrite in httpd
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} ^(DELETE|TRACE|OPTIONS)$ [NC]
    RewriteRule .* - [F]

Answer 4

使用Ravikant Sharma的回应（谢谢）

找到server.xml（在我的情况下为/jboss-5.1.0.GA/server/default/deploy/jbossweb.sar）
内部标签＆lt;引擎＆gt;和＆lt;主持人＆gt;你可以看到＆lt;阀门＆gt;标签，你应该插入一个新的阀门标签：

＆LT; Valve className =＆＃34; org.jboss.web.rewrite.RewriteValve＆＃34; /＆GT;
然后在我的案例/jboss-5.1.0.GA/server/default/conf/的配置文件夹中。看看你是否有以下路径和文件（如果你没有，你需要创建它） - /jboss.web/localhost/rewrite.properties
在上面的文件中添加以下行：

RewriteCond %{REQUEST_METHOD} ^(OPTIONS)$ [NC] RewriteRule .* - [F]

因此，在配置之前，您会看到以下结果：

curl -i -X OPTIONS http://192.168.133.1:8080

HTTP / 1.1 200确定

服务器：Apache-Coyote / 1.1

X-Powered-By：Servlet 2.5; JBoss的5.0 / JBossWeb-2.1

允许：GET，HEAD，POST，PUT，DELETE，TRACE，OPTIONS

内容长度：0

日期：2016年12月28日星期三01:13:37 GMT

配置完成后，您将看到以下输出：

curl -i -X OPTIONS http://192.168.133.1:8080

HTTP / 1.1 403 Forbidden

服务器：Apache-Coyote / 1.1

Transfer-Encoding：chunked

日期：2016年12月28日星期三01:19:34 GMT

Answer 5

可以将以下属性添加到独立XML文件中undertow子系统中的http-listener和https-listener。默认情况下，它仅禁用HTTP方法TRACE。需要放置需要禁用的方法。

disallowed-methods =“ HTTP方法”

对于以下示例，禁用http方法HEAD，OPTIONS和TRACE。

<server name="default-server">
     <http-listener name="default" socket-binding="http" max-post-size="419430400" disallowed-methods="HEAD OPTIONS TRACE" redirect-socket="https" enable-http2="true"/>
     <https-listener name="https" socket-binding="https" max-post-size="419430400" disallowed-methods="HEAD OPTIONS TRACE" security-realm="ApplicationRealm" enable-http2="true"/>
     ....
</server>

如何在JBoss中禁用HTTP OPTIONS方法？

5 个答案: