web.xml中的白名单安全性约束

问题描述

我正在使用Tomcat作为我的Struts2应用程序。 web.xml 有如下所示的某些条目：

I'm using Tomcat for my Struts2 application. The web.xml has certain entries as shown below:

<security-constraint>
    <web-resource-collection>
        <web-resource-name>restricted methods</web-resource-name>
        <url-pattern>/*</url-pattern>
        <http-method>PUT</http-method>
        <http-method>DELETE</http-method>
        <http-method>TRACE</http-method>
    </web-resource-collection>
    <auth-constraint />
</security-constraint>
<security-constraint>
   <web-resource-collection>
       <web-resource-name>no_access</web-resource-name>
       <url-pattern>/jsp/*</url-pattern>
   </web-resource-collection>
   <auth-constraint/>
</security-constraint>
    <security-constraint>
   <web-resource-collection>
       <web-resource-name>no_access</web-resource-name>
       <url-pattern>/myrrunner/*</url-pattern>
   </web-resource-collection>
   <auth-constraint/>
</security-constraint>

如何更改上面列入黑名单的部分以仅使用白名单部分......例如，不要将黑名单改为黑名单 PUT ， DELTE http方法，我需要将其他方法列入白名单，但我不确定将它们列入白名单的语法;什么方法将它们列入白名单。

How can I change above blacklisted parts to use only whitelisting part... For example, instead of blacklisting PUT, DELTE http methods, I need to whitelist other methods but I'm not sure the syntax of whitelisting them & what methods to whitelist them.

对于我上面的 web.xml 片段，如果有人可以为我提供whitelisitng计数器部分，我将不胜感激高于 xml 。

For my above web.xml snippet, I'll appreciate if some one can provide me whitelisitng counter part for above xml.

编辑：此外，我如何才能真正验证解决方案是否有效？

Also, how would I really verify whether the solution works or not?

谢谢

推荐答案

我会尝试以下方法：

<security-constraint>
    <web-resource-collection>
        <url-pattern>/*</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
    </web-resource-collection>
    <!-- no auth-constraint tag here -->
</security-constraint>

<security-constraint>
    <web-resource-collection>
        <web-resource-name>restricted methods</web-resource-name>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>
   <auth-constraint/>
</security-constraint>

第一个安全约束没有任何 auth-constraint ，所以没有登录的任何人都可以使用GET和POST方法。第二个限制每个人的其他http方法。 （我还没试过。）

The first security-constraint does not have any auth-constraint, so the GET and POST methods are available to anyone without login. The second restricts other http methods for everybody. (I haven't tried it.)

这篇关于web.xml中的白名单安全性约束的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！