How to intercept a RequestRejectedException in Spring?

I am seeing a ton of RequestRejectedException entries in my Tomcat log (sample pasted below). These started appearing in my log file after a minor version upgrade (Spring Security 4.2.4, IIRC) a few months ago, so this is clearly a new security feature in Spring that is enabled by default. A similar issue is reported here, but my question involves specifically how to intercept these exceptions in a controller. There is a Spring Security bug documented for this problem (Provide a way to handle RequestRejectedException). However, they aren't targeting a fix for this problem until Spring 5.1.

RequestRejectedException

I understand why these exceptions are being thrown, and I do not want to disable this security feature.

I want to gain some control over this feature so that:

500 Internal Server Error

400 Bad Request

I want to find a way to log the URL that was requested, but also suppress the stack trace specifically for these exceptions because they are polluting my log files without giving me any helpful information. Optimally, I'd like to intercept these exceptions and handle them in my application layer instead of reporting them in the Tomcat log at all.

For example, this is one of thousands of these log entries that appear every day in my catalina.out:

catalina.out

Aug 10, 2018 2:01:36 PM org.apache.catalina.core.StandardWrapperValve invoke SEVERE: Servlet.service() for servlet [dispatcher] in context with path threw exception org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String ";" at org.springframework.security.web.firewall.StrictHttpFirewall.rejectedBlacklistedUrls(StrictHttpFirewall.java:265) at org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:245) at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:193) at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177) at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:347) at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:263) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:496) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) at org.apache.coyote.ajp.AjpProcessor.service(AjpProcessor.java:486) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:790) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1459) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748)

I'm seeing over 3,200 of these in a two day period, and it has quickly become the single largest contributor to my catalina.out log file, to the point that it prevents me from seeing other, legitimate problems. Essentially, this new Spring Security feature is a form of built-in Denial-of-Service, and it has wasted hours of my time since April. I am not saying that it is not an important feature, simply that the default implementation is completely botched, and I want to find a way gain some control over it, both as a developer and as a systems administrator.

catalina.out

I use a custom Error Controller for intercepting many other Exception types (including IOException) in Spring. However, RequestRejectedException seems to be falling through for some reason.

IOException

RequestRejectedException

This is the relevant part of my ErrorController.java, to give an idea of what I'm trying to accomplish:

ErrorController.java

@ControllerAdvice public final class ErrorController /** * Logger. */ private static final Logger LOGGER = Logger.getLogger(ErrorController.class.getName()); /** * Generates an Error page by intercepting exceptions generated from HttpFirewall. * * @param ex A RequestRejectedException exception. * @return The tile definition name for the page. */ @ExceptionHandler(RequestRejectedException.class) @ResponseStatus(HttpStatus.BAD_REQUEST) public String handleRequestRejectedException(final HttpServletRequest request, final RequestRejectedException ex) if (LOGGER.isLoggable(Level.INFO)) LOGGER.log(Level.INFO, "Request Rejected", ex); LOGGER.log(Level.WARNING, "Rejected request for [" + request.getRequestURL().toString() + "]. Reason: " + ex.getMessage()); return "errorPage"; /** * Generates a Server Error page. * * @param ex An exception. * @return The tile definition name for the page. */ @ExceptionHandler(Exception.class) @ResponseStatus(HttpStatus.INTERNAL_SERVER_ERROR) public String handleException(final Exception ex) if (LOGGER.isLoggable(Level.SEVERE)) LOGGER.log(Level.SEVERE, "Server Error", ex); return "errorPage";

This error controller works for many exceptions. For example, it successfully intercepted this IllegalStateException:

IllegalStateException

Aug 05, 2018 7:50:30 AM com.mycompany.spring.controller.ErrorController handleException SEVERE: Server Error java.lang.IllegalStateException: Cannot create a session after the response has been committed at org.apache.catalina.connector.Request.doGetSession(Request.java:2999) ...

However, this is not intercepting RequestRejectedException (as indicated by the lack of "Server Error" in the first log sample above).

RequestRejectedException

How can I intercept RequestRejectedException in an error controller?

RequestRejectedException

3 Answers
3

I implemented a subclass of StrictHttpFirewall that logs request information to the console and throws a new exception with a suppressed stack trace. This partially solves my problem (at least I can see the bad requests now).

StrictHttpFirewall

If you just want to see the rejected requests without the stack trace, this is the answer you're looking for.

If you want to handle these exceptions in a controller, please refer to the accepted answer for a complete (but slightly more complex) solution.

LoggingHttpFirewall.java

This class extends StrictHttpFirewall to catch RequestRejectedException and throws a new exception with metadata from the request and a suppressed stack trace.

RequestRejectedException

WebSecurityConfig.java

In WebSecurityConfig, set the HTTP firewall to the LoggingHttpFirewall.

WebSecurityConfig

LoggingHttpFirewall

@EnableWebSecurity public class WebSecurityConfig extends WebSecurityConfigurerAdapter /** * Default constructor. */ public WebSecurityConfig() super(); return; @Override public final void configure(final WebSecurity web) throws Exception super.configure(web); web.httpFirewall(new LoggingHttpFirewall()); // Set the custom firewall. return;

Results

After deploying this solution to production, I quickly discovered that the default behavior of StrictHttpFirewall was blocking Google from indexing my site!

StrictHttpFirewall

Aug 13, 2018 1:48:56 PM com.mycompany.spring.security.AnnotatingHttpFirewall getFirewalledRequest WARNING: Intercepted RequestBlockedException: Remote Host: 66.249.64.223 User Agent: Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) Request URL: https://www.mycompany.com/10.1601/tx.3784;jsessionid=692804549F9AB55F45DBD0AFE2A97FFD

As soon as I discovered this, I quickly deployed a new version (included in my other answer) that looks for ;jsessionid= and allows these requests through. There may well be other requests that should pass through as well, and now I have a way of detecting these.

;jsessionid=

It can be also handled by a simple filter, which will lead to 404 error response

@Component @Slf4j @Order(Ordered.HIGHEST_PRECEDENCE) public class LogAndSuppressRequestRejectedExceptionFilter extends GenericFilterBean @Override public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException try chain.doFilter(req, res); catch (RequestRejectedException e) HttpServletRequest request = (HttpServletRequest) req; HttpServletResponse response = (HttpServletResponse) res; log .warn( "request_rejected: remote=, user_agent=, request_url=", request.getRemoteHost(), request.getHeader(HttpHeaders.USER_AGENT), request.getRequestURL(), e ); response.sendError(HttpServletResponse.SC_NOT_FOUND);

This is a very unappreciated answer. Thanks for the simple solution!

– ArmedChef
Jan 17 at 22:17

The most sane solution of all.

– arctica
Feb 4 at 12:23

It turns out that although HttpFirewall and StrictHttpFirewall contain several design errors (documented in the code below), it is just barely possible to escape Spring Security's One True Firewall and tunnel the HttpFirewall information via a request attribute to a HandlerInterceptor that can pass these flagged requests to a real (persistent) firewall without sacrificing the original business logic that flagged them in the first place. The method documented here should be fairly future-proof, as it conforms to a simple contract from the HttpFirewall interface, and the rest is simply the core Spring Framework and Java Servlet API.

HttpFirewall

StrictHttpFirewall

HttpFirewall

HandlerInterceptor

HttpFirewall

This is essentially a more complicated but more complete alternative to my earlier answer. In this answer, I implemented a new subclass of StrictHttpFirewall that intercepts and logs rejected requests at a specific logging level, but also adds an attribute to the HTTP request that flags it for downstream filters (or controllers) to handle. Also, this AnnotatingHttpFirewall provides an inspect() method that allows subclasses to add custom rules for blocking requests.

StrictHttpFirewall

AnnotatingHttpFirewall

inspect()

This solution is split into two parts: (1) Spring Security and (2) Spring Framework (Core), because that is the divide that caused this problem in the first place, and this shows how to bridge it.

For reference, this is tested on Spring 4.3.17 and Spring Security 4.2.6. There may be significant changes when Spring 5.1 is released.

Part 1: Spring Security

This is the half of the solution that performs the logging and flagging within Spring Security.

AnnotatingHttpFirewall.java

import java.util.logging.Level; import java.util.logging.Logger; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import org.springframework.security.web.firewall.FirewalledRequest; import org.springframework.security.web.firewall.RequestRejectedException; import org.springframework.security.web.firewall.StrictHttpFirewall; /** * Overrides the StrictHttpFirewall to log some useful information about blocked requests. */ public class AnnotatingHttpFirewall extends StrictHttpFirewall /** * The name of the HTTP header representing a request that has been rejected by this firewall. */ public static final String HTTP_HEADER_REQUEST_REJECTED_FLAG = "X-HttpFirewall-RequestRejectedFlag"; /** * The name of the HTTP header representing the reason a request has been rejected by this firewall. */ public static final String HTTP_HEADER_REQUEST_REJECTED_REASON = "X-HttpFirewall-RequestRejectedReason"; /** * Logger. */ private static final Logger LOGGER = Logger.getLogger(AnnotatingHttpFirewall.class.getName()); /** * Default constructor. */ public AnnotatingHttpFirewall() super(); return; /** * Provides the request object which will be passed through the filter chain. * * @param request The original HttpServletRequest. * @returns A FirewalledRequest (required by the HttpFirewall interface) which * inconveniently breaks the general contract of ServletFilter because * we can't upcast this to an HttpServletRequest. This prevents us * from re-wrapping this using an HttpServletRequestWrapper. */ @Override public FirewalledRequest getFirewalledRequest(final HttpServletRequest request) try this.inspect(request); // Perform any additional checks that the naive "StrictHttpFirewall" misses. return super.getFirewalledRequest(request); catch (RequestRejectedException ex) final String requestUrl = request.getRequestURL().toString(); // Override some of the default behavior because some requests are // legitimate. if (requestUrl.contains(";jsessionid=")) // Do not block non-cookie serialized sessions. Google's crawler does this often. else // Log anything that is blocked so we can find these in the catalina.out log. // This will give us any information we need to make // adjustments to these special cases and see potentially // malicious activity. if (LOGGER.isLoggable(Level.WARNING)) LOGGER.log(Level.WARNING, "Intercepted RequestBlockedException: Remote Host: " + request.getRemoteHost() + " User Agent: " + request.getHeader("User-Agent") + " Request URL: " + request.getRequestURL().toString()); // Mark this request as rejected. request.setAttribute(HTTP_HEADER_REQUEST_REJECTED, Boolean.TRUE); request.setAttribute(HTTP_HEADER_REQUEST_REJECTED_REASON, ex.getMessage()); // Suppress the RequestBlockedException and pass the request through // with the additional attribute. return new FirewalledRequest(request) @Override public void reset() return; ; /** * Provides the response which will be passed through the filter chain. * This method isn't extensible because the request may already be committed. * Furthermore, this is only invoked for requests that were not blocked, so we can't * control the status or response for blocked requests here. * * @param response The original HttpServletResponse. * @return the original response or a replacement/wrapper. */ @Override public HttpServletResponse getFirewalledResponse(final HttpServletResponse response) // Note: The FirewalledResponse class is not accessible outside the package. return super.getFirewalledResponse(response); /** * Perform any custom checks on the request. * This method may be overridden by a subclass in order to supplement or replace these tests. * * @param request The original HttpServletRequest. * @throws RequestRejectedException if the request should be rejected immediately. */ public void inspect(final HttpServletRequest request) throws RequestRejectedException final String requestUri = request.getRequestURI(); // path without parameters // final String requestUrl = request.getRequestURL().toString(); // full path with parameters if (requestUri.endsWith("/wp-login.php")) throw new RequestRejectedException("The request was rejected because it is a vulnerability scan."); if (requestUri.endsWith(".php")) throw new RequestRejectedException("The request was rejected because it is a likely vulnerability scan."); return; // The request passed all custom tests.

WebSecurityConfig.java

In WebSecurityConfig, set the HTTP firewall to the AnnotatingHttpFirewall.

WebSecurityConfig

AnnotatingHttpFirewall

@EnableWebSecurity public class WebSecurityConfig extends WebSecurityConfigurerAdapter /** * Default constructor. */ public WebSecurityConfig() super(); return; @Override public final void configure(final WebSecurity web) throws Exception super.configure(web); web.httpFirewall(new AnnotatingHttpFirewall()); // Set the custom firewall. return;

Part 2: Spring Framework

The second part of this solution could conceivably be implemented as a ServletFilter or HandlerInterceptor. I'm going the path of a HandlerInterceptor because it seems to give the most flexibility and works directly within the Spring Framework.

ServletFilter

HandlerInterceptor

RequestBlockedException.java

This custom exception can be handled by an Error Controller. This may be extended to add any request headers, parameters or properties available from the raw request (even the full request itself) that may be pertinent to application business logic (e.g., a persistent firewall).

/** * A custom exception for situations where a request is blocked or rejected. */ public class RequestBlockedException extends RuntimeException private static final long serialVersionUID = 1L; /** * The requested URL. */ private String requestUrl; /** * The remote address of the client making the request. */ private String remoteAddress; /** * A message or reason for blocking the request. */ private String reason; /** * The user agent supplied by the client the request. */ private String userAgent; /** * Creates a new Request Blocked Exception. * * @param reqUrl The requested URL. * @param remoteAddr The remote address of the client making the request. * @param userAgent The user agent supplied by the client making the request. * @param message A message or reason for blocking the request. */ public RequestBlockedException(final String reqUrl, final String remoteAddr, final String userAgent, final String message) this.requestUrl = reqUrl; this.remoteAddress = remoteAddr; this.userAgent = userAgent; this.reason = message; return; /** * Gets the requested URL. * * @return A URL. */ public String getRequestUrl() return this.requestUrl; /** * Gets the remote address of the client making the request. * * @return A remote address. */ public String getRemoteAddress() return this.remoteAddress; /** * Gets the user agent supplied by the client making the request. * * @return A user agent string. */ public String getUserAgent() return this.userAgent; /** * Gets the reason for blocking the request. * * @return A message or reason for blocking the request. */ public String getReason() return this.reason;

FirewallInterceptor.java

This interceptor is invoked after the Spring Security filters have run (i.e., after AnnotatingHttpFirewall has flagged requests that should be rejected. This interceptor detects those flags (attributes) on the request and raises a custom exception that our Error Controller can handle.

AnnotatingHttpFirewall

import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import org.springframework.web.method.HandlerMethod; import org.springframework.web.servlet.HandlerInterceptor; import org.springframework.web.servlet.ModelAndView; /** * Intercepts requests that were flagged as rejected by the firewall. */ public final class FirewallInterceptor implements HandlerInterceptor /** * Default constructor. */ public FirewallInterceptor() return; @Override public boolean preHandle(final HttpServletRequest request, final HttpServletResponse response, final Object handler) throws Exception if (Boolean.TRUE.equals(request.getAttribute(AnnotatingHttpFirewall.HTTP_HEADER_REQUEST_REJECTED))) // Throw a custom exception that can be handled by a custom error controller. final String reason = (String) request.getAttribute(AnnotatingHttpFirewall.HTTP_HEADER_REQUEST_REJECTED_REASON); throw new RequestRejectedByFirewallException(request.getRequestURL().toString(), request.getRemoteAddr(), request.getHeader(HttpHeaders.USER_AGENT), reason); return true; // Allow the request to proceed normally. @Override public void postHandle(final HttpServletRequest request, final HttpServletResponse response, final Object handler, final ModelAndView modelAndView) throws Exception return; @Override public void afterCompletion(final HttpServletRequest request, final HttpServletResponse response, final Object handler, final Exception ex) throws Exception return;

WebConfig.java

In WebConfig, add the FirewallInterceptor to the registry.

WebConfig

FirewallInterceptor

@EnableWebMvc public class WebConfig extends WebMvcConfigurerAdapter /** * Among your other methods in this class, make sure you register * your Interceptor. */ @Override public void addInterceptors(final InterceptorRegistry registry) // Register firewall interceptor for all URLs in webapp. registry.addInterceptor(new FirewallInterceptor()).addPathPatterns("/**"); return;

ErrorController.java

This specifically handles the custom exception above, and produces a clean error page for the client while logging all of the relevant information and invoking any special business logic for a custom application firewall.

import java.io.IOException; import java.util.logging.Level; import java.util.logging.Logger; import org.springframework.web.servlet.NoHandlerFoundException; import org.springframework.http.HttpStatus; import org.springframework.web.bind.annotation.ControllerAdvice; import org.springframework.web.bind.annotation.ExceptionHandler; import org.springframework.web.bind.annotation.ResponseStatus; import RequestBlockedException; @ControllerAdvice public final class ErrorController /** * Logger. */ private static final Logger LOGGER = Logger.getLogger(ErrorController.class.getName()); /** * Generates an Error page by intercepting exceptions generated from AnnotatingHttpFirewall. * * @param request The original HTTP request. * @param ex A RequestBlockedException exception. * @return The tile definition name for the page. */ @ExceptionHandler(RequestBlockedException.class) @ResponseStatus(HttpStatus.BAD_REQUEST) public String handleRequestBlockedException(final RequestBlockedException ex) if (LOGGER.isLoggable(Level.WARNING)) LOGGER.log(Level.WARNING, "Rejected request from " + ex.getRemoteAddress() + " for [" + ex.getRequestUrl() + "]. Reason: " + ex.getReason()); // Note: Perform any additional business logic or logging here. return "errorPage"; // Returns a nice error page with the specified status code. /** * Generates a Page Not Found page. * * @param ex A NoHandlerFound exception. * @return The tile definition name for the page. */ @ExceptionHandler(NoHandlerFoundException.class) @ResponseStatus(HttpStatus.NOT_FOUND) public String handleException(final NoHandlerFoundException ex) return "notFoundPage";

FirewallController.java

A controller with a default mapping that throws a NoHandlerFoundException.
This circumvents the chicken-and-egg strategy in DispatcherServlet.noHandlerFound, allowing that method to always find a mapping so that FirewallInterceptor.preHandle is always invoked. This gives RequestRejectedByFirewallException priority over NoHandlerFoundException.

NoHandlerFoundException

FirewallInterceptor.preHandle

RequestRejectedByFirewallException

NoHandlerFoundException

Why this is necessary:

As mentioned here, when a NoHandlerFoundException is thrown from DispatcherServlet (i.e., when a requested URL has no corresponding mapping), there is no way to handle the exceptions generated from the above firewall (NoHandlerFoundException is thrown prior to invoking preHandle()), so those requests will fall through to your 404 view (which is not the desired behavior in my case - you will see a lot of "No mapping found for HTTP request with URI..." messages). This could be fixed by moving the check for the special header into the noHandlerFound method. Unfortunately, there is no way to do this without writing a new Dispatcher Servlet from scratch, and then you may as well throw out the entire Spring Framework. It is impossible to extend DispatcherServlet due to the mix of protected, private and final methods, and the fact that its properties are inaccessible (no getters or setters). It is also impossible to wrap the class because there is no common interface that can be implemented. The default mapping in this class provides an elegant way to circumvent all of that logic.

NoHandlerFoundException

DispatcherServlet

NoHandlerFoundException

noHandlerFound

DispatcherServlet

Important caveat: The RequestMapping below will prevent resolution of static resources because it takes precedence over all registered ResourceHandlers. I am still looking for a workaround for this, but one possibility might be to try one of the methods for handling static resources suggested in this answer.

import org.springframework.http.HttpHeaders; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.ModelAttribute; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.servlet.NoHandlerFoundException; @Controller public final class FirewallController /** * The name of the model attribute (or request parameter for advertisement click tracking) that contains the request URL. */ protected static final String REQUEST_URL = "requestUrl"; /** * The name of the model attribute that contains the request method. */ protected static final String REQUEST_METHOD = "requestMethod"; /** * The name of the model attribute that contains all HTTP headers. */ protected static final String REQUEST_HEADERS = "requestHeaders"; /** * Default constructor. */ public FirewallController() return; /** * Populates the request URL model attribute from the HTTP request. * * @param request The HTTP request. * @return The request URL. */ @ModelAttribute(REQUEST_URL) public final String getRequestURL(final HttpServletRequest request) return request.getRequestURL().toString(); /** * Populates the request method from the HTTP request. * * @param request The HTTP request. * @return The request method (GET, POST, HEAD, etc.). */ @ModelAttribute(REQUEST_METHOD) public final String getRequestMethod(final HttpServletRequest request) return request.getMethod(); /** * Gets all headers from the HTTP request. * * @param request The HTTP request. * @return The request headers. */ @ModelAttribute(REQUEST_HEADERS) public final HttpHeaders getRequestHeaders(final HttpServletRequest request) return FirewallController.headers(request); /** * A catch-all default mapping that throws a NoHandlerFoundException. * This will be intercepted by the ErrorController, which allows preHandle to work normally. * * @param requestMethod The request method. * @param requestUrl The request URL. * @param requestHeaders The request headers. * @throws NoHandlerFoundException every time this method is invoked. */ @RequestMapping(value = "/**") // NOTE: This prevents resolution of static resources. Still looking for a workaround for this. public void getNotFoundPage(@ModelAttribute(REQUEST_METHOD) final String requestMethod, @ModelAttribute(REQUEST_URL) final String requestUrl, @ModelAttribute(REQUEST_HEADERS) final HttpHeaders requestHeaders) throws NoHandlerFoundException throw new NoHandlerFoundException(requestMethod, requestUrl, requestHeaders); /** * Gets all headers from a HTTP request. * * @param request The HTTP request. * @return The request headers. */ public static HttpHeaders headers(final HttpServletRequest request) final HttpHeaders headers = new HttpHeaders(); for (Enumeration<?> names = request.getHeaderNames(); names.hasMoreElements();) final String headerName = (String) names.nextElement(); for (Enumeration<?> headerValues = request.getHeaders(headerName); headerValues.hasMoreElements();) headers.add(headerName, (String) headerValues.nextElement()); return headers;

Results

When both parts of this are working, you'll see the following two warnings logged (the first one is in Spring Security, the second one is the Spring Framework (Core) ErrorController). Now you have full control over logging, and an extensible application firewall that you can adjust however you need.

ErrorController

Sep 12, 2018 10:24:37 AM com.mycompany.spring.security.AnnotatingHttpFirewall getFirewalledRequest WARNING: Intercepted org.springframework.security.web.firewall.RequestRejectedException: Remote Host: 0:0:0:0:0:0:0:1 User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0 Request URL: http://localhost:8080/webapp-www-mycompany-com/login.php Sep 12, 2018 10:24:37 AM com.mycompany.spring.controller.ErrorController handleException WARNING: Rejected request from 0:0:0:0:0:0:0:1 for [http://localhost:8080/webapp-www-mycompany-com/login.php]. Reason: The request was rejected because it is a likely vulnerability scan.

Thanks for contributing an answer to Stack Overflow!

But avoid …

To learn more, see our tips on writing great answers.

Required, but never shown

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

搜尋此網誌

Dfyjkt