WEB常见漏洞解决办法

一、Tomcat 点击劫持:X-Frame-Options Header未配置

X-Frame-Options响应头，赋值有如下三种：

1. DENY：无论如何不在框架中显示；
2. SAMEORIGIN：仅在同源域名下的框架中显示；
3. ALLOW-FROM uri：仅在指定域名下的框架中显示。

Tomcat

在web.xml添加如下配置

<filter-mapping>
        <filter-name>httpHeaderSecurity</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>REQUEST</dispatcher>
    </filter-mapping>

<filter>
        <filter-name>httpHeaderSecurity</filter-name>
        <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
        <async-supported>true</async-supported>
     
      <init-param>
        <param-name>antiClickJackingEnabled</param-name>
        <param-value>true</param-value>
      </init-param>
      <init-param>
        <param-name>antiClickJackingOption</param-name>
        <param-value>SAMEORIGIN</param-value>
      </init-param>    

    </filter>

二、检测到目标服务器启用OPTIONS方法

tomcat的web.xml下或则应用程序的web.xml下添加如下代码

<security-constraint>
    <web-resource-collection>
        <web-resource-name>baseproject</web-resource-name>
        <url-pattern>/*</url-pattern>
		<http-method>PUT</http-method>
		<http-method>DELETE</http-method>
		<http-method>HEAD</http-method>
		<http-method>OPTIONS</http-method>
		<http-method>TRACE</http-method>
	</web-resource-collection>
	<auth-constraint>
		<description>baseproject</description>
		<role-name>All Role</role-name>
	</auth-constraint>
</security-constraint>
<login-config>
    <auth-method>BASIC</auth-method>
</login-config>