常见安全问题加固方案汇总

upstream smartbi_tomcat{
    ip_hash;
    server 10.253.88.111:8080 weight=1;
}
server {
    listen       80;
    server_name  10.253.88.111;
    if ($host !~* ^10.253.88.111|127.0.0.1$){
        return 403;
    }
   
    # 将http请求转发到https
    #if ($scheme = http) {
    #    return 301 https://$host$request_uri;
    #}
   
    # https 证书配置
    #ssl_certificate          <证书所在路径>/<证书名称>.crt;
    #ssl_certificate_key      <证书所在路径>/<证书名称>.key;
   
    location / {
        # 注意，这里不要使用集群，直接转发到 Tomcat 服务即可
        proxy_pass        http://10.253.88.111:8080;

        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header X-Frame-Options SAMEORIGIN;

        proxy_set_header Cookie $http_cookie;
        proxy_redirect off;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        # 需要https 的支持
        #proxy_cookie_path ~^/(.+)$ "/$1; HttpOnly; secure; SameSite=none";
       
        client_max_body_size 100m;
        client_body_buffer_size 1024k;
        proxy_connect_timeout 300;
        proxy_send_timeout 300;
        proxy_read_timeout 300;
        proxy_buffer_size 4k;
        proxy_buffers 4 32k;
        proxy_busy_buffers_size 64k;
        proxy_temp_file_write_size 64k;
   }
}

<filter>
        <filter-name>httpHeaderSecurity</filter-name>
        <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
        <async-supported>true</async-supported>
        <init-param>
            <param-name>hstsEnabled</param-name>
            <param-value>true</param-value>
        </init-param>
        <init-param>
            <param-name>hstsMaxAgeSeconds</param-name>
            <!--这里设置的是有效期，生产环境测试时建议不要设置太大，测试没问题后再逐步提高这个值。如：1分钟、5分钟、10分钟、30分钟、60分钟、3个钟、6个钟、12个钟、18个钟、24个钟、半年、一年-->
            <!--单位是秒-->
            <!--一年是 31536000 -->
            <param-value>60</param-value>
        </init-param>
        <init-param>
            <param-name>hstsIncludeSubDomains</param-name>
            <param-value>true</param-value>
        </init-param>
    </filter>
    
       <filter-mapping>
        <filter-name>httpHeaderSecurity</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>REQUEST</dispatcher>
    </filter-mapping> 

http {
#指定每一个 TCP 链接最多能够保持多长时间
keepalive_timeout 60;
server {
#服务端向客户端传输数据的超时时间
send_timeout 60s;
#请求头分配一个缓冲区
client_body_buffer_size 16k;
#指定客户端与服务端建立连接后发送 request body 的超时时间
client_body_timeout 50s;
#客户端向服务端发送一个完整的 request header 的超时时间
client_header_timeout 10s;
location / {

         }
     }
}

<security-constraint>
<web-resource-collection>
<web-resource-name>filter-http-method</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>PUT</http-method>
<http-method>DELETE</http-method>
<http-method>OPTIONS</http-method>
<http-method>HEAD</http-method>
</web-resource-collection>
<auth-constraint></auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
</login-config>