Appscan安全漏洞修复
1.会话标识未更新：登录页面加入以下代码 request.getSession(true).invalidate();//清空session Cookie cookie = request.getCookies()[0];//获取cookie cookie.setMaxAge(0);//让cookie过期 request.getSession(true).invalidate();//清空session Cookie cookie = request.getCookies()[0];//获取cookie cookie.setMaxAge(0);//让cookie过期 不是很明白session的机制，高手路过可以指教一下。 2.跨站点请求伪造： 在出错的url加参数sessionid。 response.getWriter().write( "<script>parent.location.href='dbase/admin/loginJsp.action?sessionId="+sessionId+"'</script>"); response.getWriter().write( "<script>parent.location.href='dbase/admin/loginJsp.action?sessionId="+sessionId+"'</script>"); 如果带参数报ssl错误，使用下面的post方式传值： response.getWriter().write( "<script language="javascript"> " + "document.write("<form action=dbase/admin/loginJsp.action method=post name=formx1 style='display:none'>");" + "document.write("<input type=hidden name=name value='"+sessionId+"'");" + "document.write("</form>");" + "document.formx1.submit();" + "</script>" ); response.getWriter().write( "<script language="javascript"> " + "document.write("<form action=dbase/admin/loginJsp.action method=post name=formx1 style='display:none'>");" + "document.write("<input type=hidden name=name value='"+sessionId+"'");" + "document.write("</form>");" + "document.formx1.submit();" + "</script>" ); 3.启用不安全HTTP方法 修改web工程中或者服务器web.xml，增加安全配置信息，禁用不必要HTTP方法 <security-constraint> <web-resource-collection> <url-pattern>/*</url-pattern> <http-method>PUT</http-method> <http-method>DELETE</http-method> <http-method>HEAD</http-method> <http-method>OPTIONS</http-method> <http-method>TRACE</http-method> </web-resource-collection> <auth-constraint> </auth-constraint> </security-constraint> <login-config> <auth-method>BASIC</auth-method> </login-config>
