Java框架在网络安全领域的威胁防御

// Apache Tomcat Web 运用<a style='color:#f60; text-decoration:underline;' href="https://www.php.cn/zt/34453.html" target="_blank">防水墙配备</a>
<Valve className="org.<a style='color:#f60; text-decoration:underline;' href="https://www.php.cn/zt/1597两.html" target="_blank">apache</a>.catalina.valves.CSRFProtectionValve" />
<Valve className="org.apache.catalina.valves.RemoteAddrValve" />

// Jetty Web 利用防水墙安排
<Configure class="org.eclipse.jetty.webapp.WebAppContext">
  <DisplayName>Secure App</DisplayName>
  <SecurityHandler>
    <CsrfProtectionHandler>
      <WhiteListPaths>
        <PathSpec>/index.html</PathSpec>
        <PathSpec>/login.jsp</PathSpec>
      </WhiteListPaths>
    </CsrfProtectionHandler>
  </SecurityHandler>
</Configure>

// Spring Security 流毒扫描
ApplicationContext context = new ClassPathXmlApplicationContext("applicationContext.xml");

SecurityContext context = (SecurityContext) context.getBean("securityContext");
User user = (User) context.getAuthentication().getPrincipal();

// OWASP ZAP 破绽扫描
OWASPZapClient client = new OWASPZapClient("localhost", 8090);
client.scan("http://localhost:8080", "myApplication");

// Shiro 配备
<securityManager>
  <authenticator>
    <simpleAccountRealm>
      <user>admin</user>
      <password>password</password>
      <roles>admin</roles>
    </simpleAccountRealm>
  </authenticator>
</securityManager>

// Spring Security 摆设
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http
      .authorizeRequests()
      .antMatchers("/admin").hasRole("ADMIN")
      .anyRequest().authenticated()
      .and()
      .formLogin();
  }
}

// Hibernate 部署
@Entity
@Table(name="users")
public class User {
  @Id
  private Long id;

  @Column(name="username", nullable=false, length=100)
  private String username;

  // ...
}

// Spring Data JPA 盘问事例
User user = userRepository.findByUsername("john");