package com.hx.security.request;
|
|
import org.apache.tomcat.util.descriptor.web.SecurityCollection;
|
import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
|
import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
|
import org.springframework.boot.web.servlet.server.ConfigurableServletWebServerFactory;
|
import org.springframework.context.annotation.Bean;
|
import org.springframework.context.annotation.Configuration;
|
|
/**设置限制请求*/
|
@Configuration
|
public class RequestRestriction {
|
|
@Bean
|
public ConfigurableServletWebServerFactory configurableServletWebServerFactory() {
|
TomcatServletWebServerFactory factory = new TomcatServletWebServerFactory();
|
factory.addContextCustomizers(context -> {
|
SecurityConstraint securityConstraint = new SecurityConstraint();
|
securityConstraint.setUserConstraint("CONFIDENTIAL");
|
SecurityCollection collection = new SecurityCollection();
|
//设置不安全请求不能通过
|
collection.addPattern("/*");
|
collection.addMethod("HEAD");
|
collection.addMethod("PUT");
|
collection.addMethod("DELETE");
|
collection.addMethod("OPTIONS");
|
collection.addMethod("TRACE");
|
collection.addMethod("COPY");
|
collection.addMethod("SEARCH");
|
collection.addMethod("PROPFIND");
|
//collection.addMethod("PATCH");
|
securityConstraint.addCollection(collection);
|
context.addConstraint(securityConstraint);
|
});
|
return factory;
|
}
|
|
|
}
|
