Java Spring如何在webapplicationinitializer中强制使用https ssl？

Question

To force https in web.xml i was using this code snippet:

<security-constraint>
  <web-resource-collection>
      <url-pattern>/*</url-pattern>
  </web-resource-collection>
  <user-data-constraint>
      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
  </user-data-constraint>
</security-constraint>

Is there an equivalent for this in Spring Java Config? I already figured out that i need a ServletSecurityElement . But how do i connect it to the rest?

public class WebAppInitializer implements WebApplicationInitializer {
    @Override
    public void onStartup(ServletContext container) throws ServletException {
        AnnotationConfigWebApplicationContext context = new AnnotationConfigWebApplicationContext();
        container.addListener(new ContextLoaderListener(context));
        context.register(PersistenceJPAConfig.class);

        FilterRegistration filter = container.addFilter("wicket.myproject", WicketFilter.class);
        filter.setInitParameter("applicationClassName", WicketApplication.class.getName());
        filter.setInitParameter(WicketFilter.FILTER_MAPPING_PARAM, "/*");
        filter.addMappingForUrlPatterns(null, false, "/*");

        HttpConstraintElement forceHttpsConstraint = new HttpConstraintElement(ServletSecurity.TransportGuarantee.CONFIDENTIAL, "");
        ServletSecurityElement securityElement = new ServletSecurityElement(forceHttpsConstraint);
    }
}

Answer 1

As John Thompson pointed out you were right there. You just needed to add the security element you defined to the servlet. On another note I noticed you had "" as the roleNames parameter to the HttpConstraintElement . This would actually cause everyone who didn't have the role "" to be denied. If you want this to work like normal (force https) don't give any roles. In the end this worked for me:

public class ApplicationInitializer implements WebApplicationInitializer {

    private static final String DISPATCHER_SERVLET_NAME = "dispatcher";
    private static final String DISPATCHER_SERVLET_MAPPING = "/";

    @Override
    public void onStartup(ServletContext container) throws ServletException {
        // Create the dispatcher servlet's Spring application context
        AnnotationConfigWebApplicationContext dispatcherContext = new AnnotationConfigWebApplicationContext();
        dispatcherContext.register(ApplicationConfiguration.class);

        // Register and map the dispatcher servlet
        ServletRegistration.Dynamic dispatcher = container.addServlet(DISPATCHER_SERVLET_NAME, new DispatcherServlet(dispatcherContext));
        dispatcher.setLoadOnStartup(1);
        dispatcher.addMapping(DISPATCHER_SERVLET_MAPPING);

        // Force HTTPS, and don't specify any roles for this constraint
        HttpConstraintElement forceHttpsConstraint = new HttpConstraintElement(ServletSecurity.TransportGuarantee.CONFIDENTIAL);
        ServletSecurityElement securityElement = new ServletSecurityElement(forceHttpsConstraint);

        // Add the security element to the servlet
        dispatcher.setServletSecurity(securityElement);
    }
}

Answer 2

I think you need to get a handle on the servlet registration, then register the security element. Try something like this:

ServletRegistration.Dynamic registration 
     = container.addServlet("dispatcher", new DispatcherServlet());
registration.setLoadOnStartup(1);
registration.setServletSecurity(securityElement); //your prev defined securityElement

Answer 3

In the case if you use Spring Security 3.2 you could do this as follows.

<security:intercept-url pattern="/login.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY" requires-channel="https"/>

with http to https port mappings as well.

<security:port-mappings>
            <security:port-mapping http="${port.mapping.http.port}"
                https="${port.mapping.https.port}" />

Answer 4

private static final String DISPATCHER_SERVLET_NAME = "dispatcher";
private static final String DISPATCHER_SERVLET_MAPPING = "/";    
@Override
        public void onStartup(ServletContext servletContext) throws ServletException {
            AnnotationConfigWebApplicationContext rootContext = new AnnotationConfigWebApplicationContext();
            rootContext.register(ApplicationContext.class);

            ServletRegistration.Dynamic dispatcher = servletContext.addServlet(DISPATCHER_SERVLET_NAME,
                    new DispatcherServlet(rootContext));
            dispatcher.setLoadOnStartup(1);
            dispatcher.addMapping(DISPATCHER_SERVLET_MAPPING);



             HttpConstraintElement forceHttpsConstraint = new HttpConstraintElement(TransportGuarantee.CONFIDENTIAL);
                ServletSecurityElement securityElement = new ServletSecurityElement(forceHttpsConstraint);
               dispatcher.setServletSecurity(securityElement);


        }

Answer 5

What do you mean, connect it to the rest? Looks like you should be set. Spring will auto-detect the configuration of the Java configured WebApplicationInitializer.

Remember that WebApplicationInitializer implementations are detected automatically -- so you are free to package them within your application as you see fit.

See:

http://docs.spring.io/spring-framework/docs/3.1.x/javadoc-api/org/springframework/web/WebApplicationInitializer.html#onStartup(javax.servlet.ServletContext)

Answer 6

One way of do this is creating an HTTP filter inside your application:

@Component
@ConfigurationProperties("security.http")
public class ForceHTTPSFilter implements Filter {

    public static final String X_FORWARDED_PROTO_HEADER = "x-forwarded-proto";
    private boolean forceHttps = false;

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
        FilterChain chain) throws IOException, ServletException {

        if(forceHttps && !request.getProtocol().toUpperCase().contains("HTTPS") && request instanceof HttpServletRequest) {
            Optional<String> protocol = Optional.ofNullable(((HttpServletRequest)request).getHeader(X_FORWARDED_PROTO_HEADER));
            if(!protocol.orElse("http").equals("https")){
                ((HttpServletResponse)response).sendError(HttpStatus.FORBIDDEN.value(), "Please use HTTPS when submitting data to this server.");
            return;
            }
        }

        chain.doFilter(request, response);
    }

    @Override
    public void destroy() {

    }

    public boolean isForceHttps() {
        return forceHttps;
    }

    public void setForceHttps(boolean forceHttps) {
        this.forceHttps = forceHttps;
    }
}

You can switch on/off the filter with a property by using @ConfigurationProperties .

Moreover, you should inspect the header x-forwarded-proto because some proxies (like Heroku) remove the protocol from the URL and store it into this header.

And, of course here's a unit test of this filter:

public class ForceHTTPSFilterTest {

    @Rule
    public MockitoRule rule = MockitoJUnit.rule();

    @InjectMocks
    private ForceHTTPSFilter filter;

    @Test
    public void testAcceptHTTPRequestWhenFlagIsDisabled() throws Exception{

        HttpServletRequest request = mock(HttpServletRequest.class);
        when(request.getProtocol()).thenReturn("HTTP/1.1");
        HttpServletResponse response = mock(HttpServletResponse.class);
        FilterChain chain = mock(FilterChain.class);

        filter.doFilter(request, response, chain);

        verify(chain, times(1)).doFilter(any(), any());
        verify(response, never()).sendError(eq(403), anyString());
    }

    @Test
    public void testAcceptHTTPRequestWhenFlagIsEnableAndItHasForwardedProtoHeader() throws Exception{

        HttpServletRequest request = mock(HttpServletRequest.class);
        when(request.getProtocol()).thenReturn("HTTP/1.1");
        when(request.getHeader(ForceHTTPSFilter.X_FORWARDED_PROTO_HEADER)).thenReturn("https");
        HttpServletResponse response = mock(HttpServletResponse.class);
        filter.setForceHttps(true);

        FilterChain chain = mock(FilterChain.class);

        filter.doFilter(request, response, chain);

        verify(chain, times(1)).doFilter(any(), any());
        verify(response, never()).sendError(eq(403), anyString());
    }

    @Test
    public void testAcceptHTTPSRequest() throws Exception{

        HttpServletRequest request = mock(HttpServletRequest.class);
        when(request.getProtocol()).thenReturn("HTTPS/1.1");
        HttpServletResponse response = mock(HttpServletResponse.class);
        filter.setForceHttps(true);

        FilterChain chain = mock(FilterChain.class);

        filter.doFilter(request, response, chain);

        verify(chain, times(1)).doFilter(any(), any());
        verify(response, never()).sendError(eq(403), anyString());
    }

    @Test
    public void testRejectHTTPRequestWhenFlagIsEnableAndItDoesntHaveForwardedProtoHeader() throws Exception{

        HttpServletRequest request = mock(HttpServletRequest.class);
        when(request.getProtocol()).thenReturn("HTTP/1.1");
        HttpServletResponse response = mock(HttpServletResponse.class);

        filter.setForceHttps(true);

        FilterChain chain = mock(FilterChain.class);

        filter.doFilter(request, response, chain);

        verify(chain, never()).doFilter(any(), any());
        verify(response, times(1)).sendError(eq(403), anyString());
    }
}

Answer 7

None of the above answer are good enough when using Spring Boot and External Tomcat. Here the correct configuration:

super() must be called and the existing dispatcher servlet must be taken from the existing container.

private static final String DISPATCHER_SERVLET_NAME = "dispatcherServlet";

@Override
public void onStartup(ServletContext container) throws ServletException {
    super.onStartup(container);

    // Get the existing dispatcher servlet
    ServletRegistration.Dynamic dispatcher = (ServletRegistration.Dynamic)
                        container.getServletRegistration(DISPATCHER_SERVLET_NAME);

    // Force HTTPS, and don't specify any roles for this constraint
    HttpConstraintElement forceHttpsConstraint = 
         new HttpConstraintElement(ServletSecurity.TransportGuarantee.CONFIDENTIAL);
    ServletSecurityElement securityElement = 
         new ServletSecurityElement(forceHttpsConstraint);

    // Add the security element to the servlet
    dispatcher.setServletSecurity(securityElement);
}