springboot禁用内置Tomcat的不安全请求方法

起因：安全组针对接口测试提出的要求，需要关闭不安全的请求方法，例如put、delete等方法，防止服务端资源被恶意篡改。

用过springMvc都知道可以使用@PostMapping、@GetMapping等这种注解限定单个接口方法类型，或者是在@RequestMapping中指定method属性。这种方式比较麻烦，那么有没有比较通用的方法，通过查阅相关资料，答案是肯定的。

tomcat传统形式通过配置web.xml达到禁止不安全的http方法

    <security-constraint>
       <web-resource-collection>
          <url-pattern>/*</url-pattern>
          <http-method>PUT</http-method>
    	  <http-method>DELETE</http-method>
    	  <http-method>HEAD</http-method>
    	  <http-method>OPTIONS</http-method>
    	  <http-method>TRACE</http-method>
       </web-resource-collection>
       <auth-constraint>
       </auth-constraint>
    </security-constraint>
    <login-config>
      <auth-method>BASIC</auth-method>
    </login-config>

Spring boot使用内置tomcat，2.0版本以前使用如下形式

@Bean
public EmbeddedServletContainerFactory servletContainer() {
    TomcatEmbeddedServletContainerFactory tomcat = new TomcatEmbeddedServletContainerFactory() {// 1
        protected void postProcessContext(Context context) {
            SecurityConstraint securityConstraint = new SecurityConstraint();
            securityConstraint.setUserConstraint("CONFIDENTIAL");
            SecurityCollection collection = new SecurityCollection();
            collection.addPattern("/*");
            collection.addMethod("HEAD");
            collection.addMethod("PUT");
            collection.addMethod("DELETE");
            collection.addMethod("OPTIONS");
            collection.addMethod("TRACE");
            collection.addMethod("COPY");
            collection.addMethod("SEARCH");
            collection.addMethod("PROPFIND");
            securityConstraint.addCollection(collection);
            context.addConstraint(securityConstraint);
        }
    };

2.0版本使用以下形式

@Bean
public ConfigurableServletWebServerFactory configurableServletWebServerFactory() {
    TomcatServletWebServerFactory factory = new TomcatServletWebServerFactory();
    factory.addContextCustomizers(context -> {
        SecurityConstraint securityConstraint = new SecurityConstraint();
        securityConstraint.setUserConstraint("CONFIDENTIAL");
        SecurityCollection collection = new SecurityCollection();
        collection.addPattern("/*");
        collection.addMethod("HEAD");
        collection.addMethod("PUT");
        collection.addMethod("DELETE");
        collection.addMethod("OPTIONS");
        collection.addMethod("TRACE");
        collection.addMethod("COPY");
        collection.addMethod("SEARCH");
        collection.addMethod("PROPFIND");
        securityConstraint.addCollection(collection);
        context.addConstraint(securityConstraint);
    });
    return factory;
}

关于内嵌tomcat的更多配置，感兴趣可以阅读以下官方文档。

参考链接：https://docs.spring.io/spring-boot/docs/2.0.0.RC1/reference/htmlsingle/#howto-configure-tomcat

本文首发于个人公众号：河岸飞流，欢迎订阅

原文链接：https://mp.weixin.qq.com/s/bqUwkqZyHQEkWDR9fqEqJA