本文共 4412 字，大约阅读时间需要 14 分钟。

在使用 spring security 时，请求的地址栏使用 “//”的情况是后台报如下错误：

org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String "//"	at org.springframework.security.web.firewall.StrictHttpFirewall.rejectedBlacklistedUrls(StrictHttpFirewall.java:369)	at org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:336)	at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:194)	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358)	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271)	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:526)	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:861)	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1579)	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)	at java.lang.Thread.run(Thread.java:748)

该错误发生的原因是 SpringSecurity设置了安全防护措施，在 StrictHttpFirewall类中设置了禁用，源码里面如下:

因为这个allowUrlEncodedDoubleSlash 没有设置值.默认是false, 故不能识别 双 ///** * 因为这个allowUrlEncodedDoubleSlash 没有设置值.默认是false, 故不能识别 双 // * 而 FORBIDDEN_DOUBLE_FORWARDSLASH 和 FORBIDDEN_DOUBLE_FORWARDSLASH 是 SpringSecurity源码中设置的全局变量 */public void setAllowUrlEncodedDoubleSlash(boolean allowUrlEncodedDoubleSlash) {
           if (allowUrlEncodedDoubleSlash) {
               this.urlBlacklistsRemoveAll(FORBIDDEN_DOUBLE_FORWARDSLASH);        } else {
               this.urlBlacklistsAddAll(FORBIDDEN_DOUBLE_FORWARDSLASH);        }    }

需要在自己项目中的 SpringSecurity配置类中添加如下配置即可:

/**	 * 配置地址栏不能识别 // 的情况	 * @return	 */	@Bean	public HttpFirewall allowUrlEncodedSlashHttpFirewall() {
   		StrictHttpFirewall firewall = new StrictHttpFirewall();		//此处可添加别的规则,目前只设置 允许双 //		firewall.setAllowUrlEncodedDoubleSlash(true);		return firewall;	}

基本上设置如上配置，应该就能解决 双 // 的问题了，此处做个记录，方便学习

转载地址：https://blog.csdn.net/qq_26848943/article/details/103404218 如侵犯您的版权，请留言回复原文章的地址，我们会给您删除此文章，给您带来不便请您谅解！