Web常见安全漏洞修复方案
一、安全检测工具
1. SSL/TLS兼容性检测
- SSL Labs测试平台: https://www.ssllabs.com/ssltest/
- MySSL工具: https://myssl.com/
- 域名输入后自动分析协议兼容性
2. 高危漏洞扫描
- 0day漏洞库: http://0day.websaas.com.cn/
3. ZAP渗透测试工具
开源特性:
- 漏洞评估：系统化扫描安全缺陷
- 渗透测试：模拟攻击验证防御能力
- 代码审计：逐行审查源代码安全隐患
- 运行时测试：实时监控用户操作安全
使用示例：
# JDK11环境启动ZAP
java -jar zaproxy-2.12.0.jar
二、加密套件强度检测（Nmap）
安装配置:
sudo yum install nmap
检测命令:
nmap -sV --script ssl-enum-ciphers -p 443 example.com
输出示例:
Nmap scan report for example.com
| ssl-enum-ciphers:
| TLSv1.2:
| ciphers:
| TLS_AES_256_GCM_SHA384 - strong
| TLS_CHACHA20_POLY1305_SHA256 - strong
| compressors:
| NULL
|_ least strength: strong
三、Cookie安全加固
1. 安全属性设置
Java实现:
// 会话Cookie增强
Cookie sessionCookie = new Cookie("SESSIONID", "abc123");
sessionCookie.setHttpOnly(true);
sessionCookie.setSecure(true);
sessionCookie.setPath("/");
response.addCookie(sessionCookie);
Jetty配置:
<session-config>
<cookie-config>
<http-only>true</http-only>
<secure>true</secure>
<same-site>Strict</same-site>
</cookie-config>
</session-config>
Nginx代理配置:
location / {
proxy_cookie_path / "/; HttpOnly; Secure; SameSite=Strict";
}
2. SameSite属性缺失修复
Spring拦截器实现:
@Override
public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) {
Cookie[] cookies = request.getCookies();
if (cookies != null) {
for (Cookie cookie : cookies) {
String headerValue = String.format("%s=%s; Path=/; Secure; HttpOnly; SameSite=Strict",
cookie.getName(), cookie.getValue());
response.setHeader("Set-Cookie", headerValue);
}
}
}
四、Clickjacking防护
1. X-Frame-Options策略
Nginx配置:
add_header X-Frame-Options "SAMEORIGIN";
2. 内容安全策略（CSP）
多域配置示例:
add_header Content-Security-Policy "frame-ancestors 'self' https://trusted-domain.com";
五、TLS/SSL加固
1. LOGJAM攻击防御
JDK参数配置:
-Djdk.tls.ephemeralDHKeySize=2048
Jetty套件排除:
<Set name="ExcludeCipherSuites">
<Array type="String">
<Item>TLS_DHE_RSA_WITH_AES_256_CBC_SHA</Item>
<Item>TLS_DHE_DSS_WITH_AES_128_CBC_SHA</Item>
</Array>
</Set>
2. Sweet32漏洞修复
Nginx配置:
ssl_ciphers HIGH:!aNULL:!MD5:!3DES;
六、HSTS强制HTTPS
Jetty配置:
<New id="sslHttpConfig" class="org.eclipse.jetty.server.HttpConfiguration">
<Call name="addCustomizer">
<Arg>
<New class="org.eclipse.jetty.server.SecureRequestCustomizer">
<Arg name="stsMaxAgeSeconds">31536000</Arg>
<Arg name="stsIncludeSubdomains">true</Arg>
</New>
</Arg>
</Call>
</New>
Nginx配置:
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains" always;
七、CSRF防护策略
Referer校验实现:
map $http_referer $valid_referer {
default 0;
"~^https://(www\.)?example\.com" 1;
}
server {
if ($valid_referer = 0) {
return 403;
}
}
八、Content-Security-Policy优化
严格策略配置:
add_header Content-Security-Policy "default-src 'self';
script-src 'strict-dynamic' 'self';
connect-src 'self';
img-src 'self' data:;
style-src 'self' 'unsafe-inline';";
九、混合内容拦截
自动升级策略:
add_header Content-Security-Policy "upgrade-insecure-requests";
十、第三方链接安全
安全属性添加:
<a href="https://external.com" target="_blank"
rel="noopener noreferrer">安全链接</a>
属性说明:
noopener：防止新窗口访问原始文档noreferrer：屏蔽Referer头信息
