網(wǎng)站漏洞解決-[輕微]WEB服務(wù)器啟動(dòng)了OPTIONS方法 360網(wǎng)站安全檢測(cè)
電腦知識(shí) 由土鳳凰供稿使用了360網(wǎng)站安全檢測(cè) 查到有OPTIONS方法
找到這個(gè)方法奈何http.conf 找不到無(wú)論在tomcat目錄里還是linux路徑下的/usr/etc或者apache2
最后通過(guò)開(kāi)源中國(guó)找到
第一步:修改應(yīng)用程序的web.xml文件的協(xié)議
<?xml version="1.0" encoding="UTF-8"?> <web-app xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd" version="2.4">
第二步:在應(yīng)用程序的web.xml中添加如下的代碼即可
<security-constraint> <web-resource-collection> <url-pattern>/*</url-pattern> <http-method>PUT</http-method> <http-method>DELETE</http-method> <http-method>HEAD</http-method> <http-method>OPTIONS</http-method> <http-method>TRACE</http-method> </web-resource-collection> <auth-constraint> </auth-constraint> </security-constraint> <login-config> <auth-method>BASIC</auth-method> </login-config>
重新部署程序,重啟tomcat即可完成
如果用戶要驗(yàn)證既可以將POST和GET也添加在其中,重新部署并啟動(dòng)tomcat即可看到效果
以上的代碼添加到某一個(gè)應(yīng)用中,也可以添加到tomcat的web.xml中,區(qū)別是添加到某一個(gè)應(yīng)用只對(duì)某一個(gè)應(yīng)用有效如果添加到tomcat的web.xml中,則對(duì)tomcat下所有的應(yīng)用有效。
<
security-constraint
>
<
web-resource-collection
>
<
url-pattern
>/*</
url-pattern
>
<
http-method
>PUT</
http-method
>
<
http-method
>DELETE</
http-method
>
<
http-method
>HEAD</
http-method
>
<
http-method
>OPTIONS</
http-method
>
<
http-method
>TRACE</
http-method
>
</
web-resource-collection
>
<
auth-constraint
>
</
auth-constraint
>
</
security-constraint
>
<
login-config
>
<
auth-method
>BASIC</
auth-method
>
</
login-config
>