该请求被拒绝,因为白名单[HEAD,DELETE,POST,GET,OPTIONS,PATCH,PUT]中未包含HTTP方法“ CONNECT”

当在AWS中部署为.war时,出现RequestRejectedException异常。但是,当我在Heroku中将其部署为.jar时,确实发生了任何异常。 谁能帮助我了解为什么会这样?

我没有在我的应用程序中的任何地方请求HTTP“ Connet”。

  

2019-06-21 12:15:40,377错误osbwssupport.ErrorPageFilter-由于异常而从请求[/]转发到错误页面[该请求被拒绝,因为白名单中未包含HTTP方法“ CONNECT” [ HEAD,DELETE,POST,GET,OPTIONS,PATCH,PUT]]   org.springframework.security.web.firewall.RequestRejectedException:由于白名单[HEAD,DELETE,POST,GET,OPTIONS,PATCH,PUT]中未包含HTTP方法“ CONNECT”,因此请求被拒绝           在org.springframework.security.web.firewall.StrictHttpFirewall.rejectForbiddenHttpMethod(StrictHttpFirewall.java:316)           在org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:292)           在org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:194)           在org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)           在org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357)           在org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270)           在org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)           在org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)           在org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99)           在org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)           在org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)           在org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)           在org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:92)           在org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)           在org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)           在org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)           在org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:93)           在org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)           在org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)           在org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)           在org.springframework.boot.web.servlet.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:130)           在org.springframework.boot.web.servlet.support.ErrorPageFilter.access $ 000(ErrorPageFilter.java:66)           在org.springframework.boot.web.servlet.support.ErrorPageFilter $ 1.doFilterInternal(ErrorPageFilter.java:105)           在org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)           在org.springframework.boot.web.servlet.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:123)           在org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)           在org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)           在org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.filterAndRecordMetrics(WebMvcMetricsFilter.java:117)           在org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:106)           在org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)           在org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)           在org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)           在org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200)           在org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)           在org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)           在org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)           在org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198)           在org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)           在org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:493)           在org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)           在org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81)           在org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:685)           在org.apache.catalina.valves.AbstractaccessLogValve.invoke(AbstractaccessLogValve.java:650)           在org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)           在org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342)           在org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:800)           在org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)           在org.apache.coyote.AbstractProtocol $ ConnectionHandler.process(AbstractProtocol.java:800)           在org.apache.tomcat.util.net.NioEndpoint $ SocketProcessor.doRun(NioEndpoint.java:1471)           在org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)           在java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)           在java.util.concurrent.ThreadPoolExecutor $ Worker.run(ThreadPoolExecutor.java:624)           在org.apache.tomcat.util.threads.TaskThread $ WrappingRunnable.run(TaskThread.java:61)           在java.lang.Thread.run(Thread.java:748)

public void configure(HttpSecurity http) throws Exception {
http.csrf().disable().
    authorizeRequests()
        .antMatchers("/css/**","/js/**","/img/**","/scss/**","/vendor/**","/public/**","/**","/static/**","/admin/**").permitAll()
        .antMatchers("/callbackurl/**").permitAll()
        .antMatchers("/").permitAll()
        .antMatchers(HttpMethod.POST,"/login").permitAll()
        .antMatchers("/api/**").permitAll() 
        .anyRequest().authenticated();

}

mnn1987 回答:该请求被拒绝,因为白名单[HEAD,DELETE,POST,GET,OPTIONS,PATCH,PUT]中未包含HTTP方法“ CONNECT”

default不允许将CONNECT作为HTTP方法

  

如果您尝试发送TRACE或CONNECT,则将其视为被禁止的HTTP方法,因此,将抛出一条消息“该请求被拒绝,因为HTTP方法未包括在白名单中,因此该请求被拒绝”。

尝试使用setAllowedHttpMethods

添加它
  

您可以通过使用方法setAllowedHttpMethods指定自己的白名单来覆盖此行为。也可以通过调用setUnsafeAllowAnyHttpMethod(boolean)将其关闭并允许任何HTTP方法,但这将使您容易受到HTTP动词篡改和XST攻击。

本文链接:https://www.f2er.com/3151442.html

大家都在问