Tomcat正在返回HTTP状态400–当我尝试在URL中发送特殊字符时，请求状态错误

Question

每当我尝试在 Mozilla Firefox 浏览器中按如下方式在 URL 中放置特殊字符时

https://URL/|

或

https://URL/]

Tomcat返回HTTP状态400-错误请求和异常堆栈跟踪，如下所示。

Type Exception Report

Message Invalid character found in the request target. The valid characters are defined in RFC 7230 and RFC 3986

Description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing).

Exception

java.lang.IllegalArgumentException: Invalid character found in the request target. The valid characters are defined in RFC 7230 and RFC 3986
    org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:474)
    org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:294)
    org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
    org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:770)
    org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1415)
    org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    java.lang.Thread.run(Thread.java:748)

Note The full stack trace of the root cause is available in the server logs.

令人惊讶的是，同一个带有特殊字符的URL在Google Chrome浏览器中正常工作。

我有以下几个问题

1. 我应该在tomcat配置文件中做哪些更改，以便它不应该返回400状态代码和异常堆栈跟踪？
2. 为什么Mozilla Firefox无法对URL进行编码？

注意:我已经在部署在tomcat 9上的应用程序中为4XX类型的状态代码配置了一个公共页面，但问题是tomcat首先返回400错误请求http状态代码作为响应。

Answer 1

从这里查看放松的路径查尔和放松的查询查尔https://tomcat.apache.org/tomcat-8.5-doc/config/http.html你需要将它们设置为所有不允许转义的先前字符

Answer 2

如果需要允许字符，请将< code>relaxedQueryChars和/或< code>relaxedPathChars属性添加到server.xml文件中的< code>Connector元素。类似于:

<Connector port="8080" protocol="HTTP/1.1"
           relaxedQueryChars="[]{}^|"
           relaxedPathChars="[]{}^|"
           URIEncoding="UTF-8"
           connectionTimeout="20000"
           redirectPort="8443"/>

这些属性的文档如下：https://tomcat.apache.org/tomcat-9.0-doc/config/http.html#Standard_Implementation

如果要禁止这些字符，但显示一个漂亮的错误页面而不是堆栈跟踪，请将错误报告阀添加到服务器.xml中的 Host 元素。像这样：

<Valve className="org.apache.catalina.valves.ErrorReportValve"
       errorCode.400="webapps/ROOT/server_error.html"/>

这个阀门的文档在这里:https://Tomcat . Apache . org/Tomcat-9.0-doc/config/Valve . html # Error _ Report _ Valve