关于web系统不安全的http请求方法 OPTIONS

可在tomcat的web.xml中添加配置：

 <security-constraint>
            <web-resource-collection>
                <web-resource-name>fortune</web-resource-name>
                <url-pattern>/*</url-pattern>
                <http-method>HEAD</http-method>
                <http-method>OPTIONS</http-method>
                <http-method>TRACE</http-method>
            </web-resource-collection>
            <auth-constraint></auth-constraint>
        </security-constraint>

具体测试使用 Burb suite中的重放攻击repeater进行测试  .