springboot2如何禁用自带tomcat的session功能

第springboot2如何禁用自带tomcat的session功能protectedsynchronizedvoidstartInternal()throwsLifecycleException{

super.startInternal();

try{

load();

}catch(Throwablet){

ExceptionUtils.handleThrowable(t);

t.printStackTrace();

setState(LifecycleState.STARTING);

@Override

protectedsynchronizedvoidstopInternal()throwsLifecycleException{

setState(LifecycleState.STOPPING);

try{

unload();

}catch(Throwablet){

ExceptionUtils.handleThrowable(t);

t.printStackTrace();

super.stopInternal();

@Override

publicvoidload()throwsClassNotFoundException,IOException{

("HttpSession已经关闭,若开启请配置：seeyon.tomcat.disableSession=false");

@Override

publicvoidunload()throwsIOException{}

@Override

publicSessioncreateSession(StringsessionId){

returnnull;

@Override

publicSessioncreateEmptySession(){

returnnull;

@Override

publicvoidadd(Sessionsession){}

@Override

publicSessionfindSession(Stringid)throwsIOException{

returnnull;

@Override

publicSession[]findSessions(){

returnnull;

@Override

publicvoidprocessExpires(){}

}

两个类解决问题，这样通过request获取session就是空了，tomcat摆脱session这层处理性能有所提升。

禁用内置Tomcat的不安全请求方法

起因：安全组针对接口测试提出的要求，需要关闭不安全的请求方法，例如put、delete等方法，防止服务端资源被恶意篡改。

用过springMvc都知道可以使用@PostMapping、@GetMapping等这种注解限定单个接口方法类型，或者是在@RequestMapping中指定method属性。这种方式比较麻烦，那么有没有比较通用的方法，通过查阅相关资料，答案是肯定的。

tomcat传统形式通过配置web.xml达到禁止不安全的http方法

security-constraint

web-resource-collection

url-pattern/*/url-pattern

http-methodPUT/http-method

http-methodDELETE/http-method

http-methodHEAD/http-method

http-methodOPTIONS/http-method

http-methodTRACE/http-method

/web-resource-collection

auth-constraint

/auth-constraint

/security-constraint

login-config

auth-methodBASIC/auth-method

/login-config

Springboot使用内置tomcat，2.0版本以前使用如下形式

@Bean

publicEmbeddedServletContainerFactoryservletContainer(){

TomcatEmbeddedServletContainerFactorytomcat=newTomcatEmbeddedServletContainerFactory(){//1

protectedvoidpostProcessContext(Contextcontext){

SecurityConstraintsecurityConstraint=newSecurityConstraint();

securityConstraint.setUserConstraint("CONFIDENTIAL");

SecurityCollectioncollection=newSecurityCollection();

collection.addPattern("/*");

collection.addMethod("HEAD");

collection.addMethod("PUT");

collection.addMethod("DELETE");

collection.addMethod("OPTIONS");

collection.addMethod("TRACE");

collection.addMethod("COPY");

collection.addMethod("SEARCH");

collection.addMethod("PROPFIND");

securityConstraint.addCollection(collection);

context.addConstraint(securityConstraint);

};

2.0版本使用以下形式

@Bean

publicConfigurableServletWebServerFactoryconfigurableServletWebServerFactory(){

TomcatServletWebServerFactoryfactory=newTomcatServletWebServerFactory();

factory.addContextCustomizers(context-{

SecurityConstraintsecurityConstraint=newSecurityConstraint();

securityConstraint.setUserConstraint("CONFIDENTIAL");

SecurityCollectioncollection=newSecurityCollection();

collection.addPattern("/*");

collection.addMethod("HEAD");

collection.addMethod("PUT");

collection.addMethod("DELETE");

collection.addMethod("OPTIONS");

collection.addMethod("TRACE");

collection.addMethod("COPY");

collection.addMethod("SEARCH");

collection.addMethod("PROPFIND")