java - 验证 WSDL URL 或禁止其暴露

Question

我需要隐藏 WSDL url 或仅使其对经过身份验证的用户可用。即我不想公开 http://localhost:8080/services/Application?wsdl .

Tomcat 版本 8.5.11、java 8、Axis 1.4(我知道 Axis 版本太旧，但这是我现在必须使用的版本)

我认为我可以按照此处 http://docs.oracle.com/cd/E19798-01/821-1841/bncbk/index.html 的说明向 web.xml 添加安全约束。如下:

<security-constraint>
    <web-resource-collection>
        <web-resource-name>WSDL</web-resource-name>
        <description>WSDL Files</description>
        <url-pattern>*?wsdl</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>*</role-name>
    </auth-constraint>
</security-constraint>

还发现这个线程建议做同样的事情但对我不起作用 Hiding WSDL in JAX-WS

Tomcat 抛出以下错误:

org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Catalina].StandardHost[localhost].StandardContext[]]
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:167)
    at org.apache.catalina.core.StandardContext.reload(StandardContext.java:3782)
    at org.apache.catalina.startup.HostConfig.reload(HostConfig.java:1377)
    at org.apache.catalina.startup.HostConfig.checkResources(HostConfig.java:1350)
    at org.apache.catalina.startup.HostConfig.check(HostConfig.java:1586)
    at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:280)
    at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:94)
    at org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1164)
    at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1388)
    at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1392)
    at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1360)
    at java.lang.Thread.run(Thread.java:748)
Caused by: java.lang.IllegalArgumentException: Invalid <url-pattern> *?wsdl in security constraint
    at org.apache.catalina.core.StandardContext.addConstraint(StandardContext.java:2827)
    at org.apache.catalina.startup.ContextConfig.configureContext(ContextConfig.java:1317)
    at org.apache.catalina.startup.ContextConfig.webConfig(ContextConfig.java:1190)
    at org.apache.catalina.startup.ContextConfig.configureStart(ContextConfig.java:775)
    at org.apache.catalina.startup.ContextConfig.lifecycleEvent(ContextConfig.java:299)
    at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:94)
    at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5087)
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
    ... 11 more

知道我做错了什么吗？或者我如何才能实现上述目标？

提前致谢

Answer 1

据我所知，Axis 1.4 不符合 JAVA WS 规范。我相信 Axis 1.4 早于 JAVA WS 规范。

我相信可以编写一个 servlet 来过滤 WSDL 文件。 https://coderanch.com/t/224470/java/Disable-wsdl-url-Axis#1054987