公司使用springboot,最近內置的tomcat版本從7升級到了8.5,發現請求參數帶{、}、[、]等字符,報以下錯誤。java
java.lang.IllegalArgumentException: Invalid character found in the request target. The valid characters are defined in RFC 7230 and RFC 3986 at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:467) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:667) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:789) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1455) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:745)
Tomcat的新版本中增長了一個新特性,就是嚴格按照 RFC 3986規範進行訪問解析,而 RFC 3986規範定義了Url中只容許包含英文字母(a-zA-Z)、數字(0-9)、-_.~4個特殊字符以及全部保留字符(RFC3986中指定了如下字符爲保留字符:! * ’ ( ) ; : @ & = + $ , / ? # [ ])。spring
tomcat.util.http.parser.HttpParser.requestTargetAllow=|{}
//springboot 版本是1.5.x @Component public class PortalTomcatWebServerCustomizer implements EmbeddedServletContainerCustomizer { @Override public void customize(ConfigurableEmbeddedServletContainer container) { if(container instanceof TomcatEmbeddedServletContainerFactory) { TomcatEmbeddedServletContainerFactory containerFactory = (TomcatEmbeddedServletContainerFactory) container; containerFactory.addConnectorCustomizers(new TomcatConnectorCustomizer() { @Override public void customize(Connector connector) { connector.setAttribute("relaxedQueryChars", "[]|{}^\`"<>"); connector.setAttribute("relaxedPathChars", "[]|"); } }); } } }