Question

我想使用AppSensor框架将入侵检测和自动响应添加到我的C＃Web应用程序中。

但我不确定如何让AppSensor API运行，以便我可以通过RESTful从我的C＃应用程序访问它。

首先让我告诉你，我不太喜欢Java / Maven / Gradle，但我知道如何从C＃访问REST API。

我尝试按照Getting Started页面从GitHub通过Git Bash命令行下载AppSensor项目：git clone https://github.com/jtmelton/appsensor.git。

然后我通过Git Bash导航到AppSensor目录（在我的电脑上）：cd appsensor

在AppSensor目录中，我按以下方式安装多模块父级：mvn -N install

完成安装后告诉我构建成功，然后我决定使用以下命令运行测试：mvn test

完成后，Git Bash告诉我每次测试都成功了。但现在我陷入了一种我不知道下一步该做什么的情景。我想部署＆＃39;我的AppSensor API，所以我可以在我的C＃应用程序中使用它。

GitHub上的某个文档说明mvn spring-boot:run应该运行/部署组件。但是，当我在appsensor-parent目录中并运行此命令时，它会给我这个错误：

[ERROR] No plugin found for prefix 'spring-boot' in the current project and in the plugin groups [org.apache.maven.plugins, org.codehaus.mojo] available from the repositories [local (C:\Users\dbr\.m2\repository), central (https://repo.maven.apache.org/maven2)] -> [Help 1]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/NoPluginFoundForPrefixException

我做了一些研究，发现命令mvn deploy应该部署组件？但是当我输入deploy命令时，它会在第一个组件（appsensor-parent）上给出一个构建错误并停止部署。它也慷慨地给了我这个错误：

[ERROR] Failed to execute goal org.sonatype.plugins:nexus-staging-maven-plugin:1.6.3:deploy (injected-nexus-deploy) on project appsensor-parent: Execution injected-nexus-deploy of goal org.sonatype.plugins:nexus-staging-maven-plugin:1.6.3:deploy failed: Server credentials with ID "ossrh" not found! -> [Help 1]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/PluginExecutionException

我还尝试过只将组件I need（AppSensor Core，分析引擎，存储，配置，访问控制器，REST客户端，REST服务器）放到一个文件夹中。然后尝试通过更改POM.XML文件来部署它，以便只有这些组件位于<modules>...</modules>但对我来说也不起作用。

然而DemoSetup的作用是什么，但我不知道在运行此演示时在哪里可以找到REST API（通过我的浏览器）。

任何人都可以通过运行REST API服务器来帮助我，这样我就可以通过浏览器和C＃应用程序访问它了吗？

Answer 1

我深入挖掘了AppSensors GitHub页面，发现我应该能够通过以下方式部署AppSensor WS Rest服务器来访问API： /example-apps/appsensor-ws-rest-server-boot

我通过将以下命令插入Git Bash来部署它：

cd appsensor
cd sample-apps
cd appsensor-ws-rest-server-boot
mvn spring-boot:run

然后我可以通过访问http://localhost:8085/api/v1.0/responses

从我的浏览器访问API

我在页面上给了我一个通知：

Page requires sending configured client application identification header.

所以一切似乎都很好但是当我刷新页面时，整个页面变成了白色而Git Bash给了我这个错误：

09:22:15.473 [http-nio-8085-exec-3] ERROR o.g.j.s.ServerRuntime$Responder - An I/O error has occurred while writing a response message entity to the container output stream.
java.lang.IllegalStateException: The output stream has already been closed.
        at org.glassfish.jersey.message.internal.CommittingOutputStream.setStreamProvider(CommittingOutputStream.java:146) ~[jersey-common-2.14.jar:na]
        at org.glassfish.jersey.message.internal.OutboundMessageContext.setStreamProvider(OutboundMessageContext.java:798) ~[jersey-common-2.14.jar:na]
        at org.glassfish.jersey.server.ContainerResponse.setStreamProvider(ContainerResponse.java:372) ~[jersey-server-2.14.jar:na]
        at org.glassfish.jersey.server.ServerRuntime$Responder.writeResponse(ServerRuntime.java:606) [jersey-server-2.14.jar:na]
        at org.glassfish.jersey.server.ServerRuntime$Responder.processResponse(ServerRuntime.java:377) [jersey-server-2.14.jar:na]
        at org.glassfish.jersey.server.ServerRuntime$Responder.process(ServerRuntime.java:420) [jersey-server-2.14.jar:na]
        at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:277) [jersey-server-2.14.jar:na]
        at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) [jersey-common-2.14.jar:na]
        at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) [jersey-common-2.14.jar:na]
        at org.glassfish.jersey.internal.Errors.process(Errors.java:315) [jersey-common-2.14.jar:na]
        at org.glassfish.jersey.internal.Errors.process(Errors.java:297) [jersey-common-2.14.jar:na]
        at org.glassfish.jersey.internal.Errors.process(Errors.java:267) [jersey-common-2.14.jar:na]
        at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:297) [jersey-common-2.14.jar:na]
        at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:254) [jersey-server-2.14.jar:na]
        at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1030) [jersey-server-2.14.jar:na]
        at org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:377) [jersey-container-servlet-core-2.14.jar:na]
        at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:381) [jersey-container-servlet-core-2.14.jar:na]
        at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:344) [jersey-container-servlet-core-2.14.jar:na]
        at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:221) [jersey-container-servlet-core-2.14.jar:na]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:291) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) [tomcat-embed-websocket-8.0.26.jar:8.0.26]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) [spring-web-4.1.7.RELEASE.jar:4.1.7.RELEASE]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.1.7.RELEASE.jar:4.1.7.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:85) [spring-web-4.1.7.RELEASE.jar:4.1.7.RELEASE]
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-4.1.7.RELEASE.jar:4.1.7.RELEASE]
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:142) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:518) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1091) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:673) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1526) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1482) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_144]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_144]
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.0.26.jar:8.0.26]
        at java.lang.Thread.run(Thread.java:748) [na:1.8.0_144]

但是当我使用Google Chromes Advanced REST client extension并导航到API时，它会给我一个200 OK。这应该意味着它确实有效并且因为它是空的而发生错误？

Answer 2

因此，在从AppSensor的开发人员那里得到一些帮助后（对John Melton大声喊叫），我能够正确地访问API。

我需要做的就是在将要使用API的客户的请求标头中添加X-Appsensor-Client-Application-Name2: myclientapp。

当您将此添加到请求的标头时，它会从Rest Server中吐出您要求的信息。我甚至能够将它实现到我的C＃Rest Client中，它给了我正确的信息！

OWASP AppSensor - 部署Java后端API

2 个答案: