host头部攻击解决方案

方法一：过滤器

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

public void doFilter(ServletRequest request, ServletResponse response,         FilterChain chain) throws IOException, ServletException {     HttpServletRequest req=(HttpServletRequest) request;     // http host头攻击漏洞校验     HttpServletResponse res = (HttpServletResponse) response;     String requestHost = req.getHeader("host");     if (requestHost != null && isRightHost(requestHost)){         res.setStatus(403);         return;     }     chain.doFilter(request, response); } // http host头漏洞攻击判断 public boolean isRightHost(String requestHost){     if(requestHost.indexOf("www.xxx.com") == -1 && requestHost.indexOf("服务器IP") == -1) {         return true;     }     return false; }

　　方法二：nginx

?

1 2 3

if ($http_Host != '域名或ip:端口'){ return 403; }或if ($http_Host !~*^域名或ip:端口$) { return 403;这里可以自定义界面 参考}

　　方法三：tomcat

Tomcat，修改server.xml文件，配置Host的name属性。

将Host里的name修改为静态的域名，如下：