[Spring Boot 실습 #2] undertow - HTTP method 제한

Spring Boot (스프링 부트) - undertow: HTTP method 제한

 

<< 환경 >>

Java           Open JDK 1.8

Spring Boot 1.5.2.RELEASE

 

 

undertow에서 HTTP method 제한 방법

 

• ContextSecurityCustomizer implements UndertowDeploymentInfoCustomizer 파일 생성 후

  ServletContextInitializer, EmbeddedServletContainerCustomizer를 구현하는 설정 파일에 @Bean객체로 추가

 

[ ContextSecurityCustomizer.java ]

import org.springframework.boot.context.embedded.undertow.UndertowDeploymentInfoCustomizer;
import org.springframework.http.HttpMethod;
 
import io.undertow.servlet.api.DeploymentInfo;
import io.undertow.servlet.api.SecurityConstraint;
import io.undertow.servlet.api.WebResourceCollection;
 
public class ContextSecurityCustomizer implements UndertowDeploymentInfoCustomizer {
 
    @Override
    public void customize(DeploymentInfo deploymentInfo) {
        SecurityConstraint constraint = new SecurityConstraint();
        WebResourceCollection webresource = new WebResourceCollection();
        webresource.addUrlPattern("/*");
        webresource.addHttpMethod(HttpMethod.PUT.toString());
        webresource.addHttpMethod(HttpMethod.DELETE.toString());
        webresource.addHttpMethod(HttpMethod.OPTIONS.toString());
        webresource.addHttpMethod(HttpMethod.HEAD.toString());
        constraint.addWebResourceCollection(webresource);
        deploymentInfo.addSecurityConstraint(constraint);
    }
 
}

 

 

[ WebConfigurer.java ]

    @Bean
    public EmbeddedServletContainerCustomizer containerCustomizer() {
        return new EmbeddedServletContainerCustomizer() {
            @Override
            public void customize(ConfigurableEmbeddedServletContainer container) {
                if (container.getClass().isAssignableFrom(UndertowEmbeddedServletContainerFactory.class)) {
                    UndertowEmbeddedServletContainerFactory undertowContainer = (UndertowEmbeddedServletContainerFactory) container;
                    undertowContainer.addDeploymentInfoCustomizers(new ContextSecurityCustomizer());
                }
            }
        };
    }

 

 

 

• 스프링 부트 실행 로그 확인

2020-12-23 23:47:43.028  INFO 148 --- [  restartedMain] portal.config.WebConfigurer              : Web application fully configured
2020-12-23 23:47:43.038  WARN 148 --- [  restartedMain] io.undertow.servlet                      : UT015020: Path /* is secured for some HTTP methods, however it is not secured for [TRACE, POST, GET, CONNECT]