一、系統暴露Tomcat、Nginx版本號

解決辦法：

1. 進入tomcat的lib目錄找到catalina.jar
2. 進入catalina.jar的org/apache/catalina/util 編輯配置檔案ServerInfo.properties
3. 修改ServerInfo.properties中的引數為

 server.info=Apache Tomcat   
  server.number=0.0.0.0 
  server.built=Nov 7 2016 20:05:27 UTC

4. 修改nginx.conf配置檔案

http {    
	server_tokens off; 　　#預設是註釋掉的
 }
 

二、防重放

理解：重放漏洞是指不法分子抓取你的增加/修改報文，不斷重新請求對應的URL造成資料重複新增操作。
思路：增加一個攔截器，攔截全部增加、修改操作，在方法請求處理之前增加一個唯一標識（UUID等）儲存至快取與request header中，在攔截器中獲取兩個值進行比較，相同則安全。
程式碼如下：
封裝ajax

function ajax(obj) {
    obj = $.extend({
        contentType: "application/x-www-form-urlencoded; charset=UTF-8"
    }, obj);
    var successFun =
 
 obj.success;
    var result;
    var recevieMsgFun = obj.recevieMsg;
    obj.success = function (data, textstatus, request) {
        var tempToken = request.getResponseHeader('token');
        if (tempToken != null && tempToken != '' && tempToken != undefined) {
            window.
 
tokenValue = tempToken;
        }
        if (typeof successFun === "function") {
            successFun(data);
        } else {
            result = data;
        }
        if(typeof recevieMsgFun!="function") {
            alert(data);
        }
        else {
            if(message && message.messageList && message.messageList.length > 0)
            {
                recevieMsgFun(message.messageList);
            }
        }
    }
    var errorFun = obj.error;
    obj.error = function (data) {
        if (typeof errorFun === "function") {
            errorFun(data);
        }
        if (data.responseText && data.responseText.indexOf("{") === 0) {
            if (typeof recevieMsgFun != "function") {
                eval("data=" + data.responseText);
                alert(data);
            }
        }
        var tempToken = data.getResponseHeader("token");
        if (tempToken != null && tempToken != '' && tempToken != undefined) {
            window.tokenValue = tempToken;
        }

    }

    obj.beforeSend = function (request) {
        request.setRequestHeader("token", window.tokenValue);
    }

    $.ajax(obj);
    return result;
}

自定義防重放攔截器 spring配置檔案

<mvc:interceptor>
   <mvc:mapping path="/**"/>
   <bean class="****.RefererInterceptor">
   <property name="includeUrls">
   <list> 
   </list>
   </property>
   </bean>
</mvc:interceptor>

RefererInterceptor.java

public class RefererInterceptor implements HandlerInterceptor {
   private Log logger = LogFactory.getLog(this.getClass());
   private final static String TOKEN_NAMESPACE = "TOKEN_NAMESPACE";
 
   private List<String> includeUrls;

   @Override
   public void afterCompletion(HttpServletRequest arg0, HttpServletResponse arg1, Object arg2, Exception arg3)
         throws Exception {}

   @Override
   public void postHandle(HttpServletRequest arg0, HttpServletResponse arg1, Object arg2, ModelAndView arg3)
         throws Exception {}

   @Override
   public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object obj) throws Exception {
      /**
       * 新增、刪除、修改操作時進行token驗證
       */
      if(isIncludeUrl(request)){     
         String token = UUID.randomUUID().toString();
         request.getSession(false).setAttribute("token", token);
         String sessionId = request.getSession().getId();
         CacheService cacheService = CacheServiceFactory.getInstance();     
         String serverToken = cacheService.getVal(TOKEN_NAMESPACE, sessionId);
         cacheService.putVal(TOKEN_NAMESPACE, sessionId, token);
         response.addHeader("token", token);
         request.setAttribute("token", token);
         String headerToken = request.getHeader("token");

         if (EmptyUtils.isEmpty(headerToken)) {
            headerToken = request.getParameter("token");
         }
         
         if (EmptyUtils.isEmpty(headerToken)  || serverToken == null || !serverToken.equals(headerToken)) {
            
            logger.error(request.getRequestURI() + "請求的token已失效"  + "  serverToken = "  +serverToken   + "  headerToken = "  + headerToken);
            return false;
         }
      }
      return true;
   }

   private boolean isIncludeUrl(HttpServletRequest request) {
      if (!EmptyUtils.isAnyoneEmpty(includeUrls)) {
         String requestPath = request.getRequestURI();
         for (String urlRegex : includeUrls) {
            Pattern p = Pattern.compile(urlRegex);
            if (p.matcher(requestPath).find()) {
               return true;
            }
         }
      }
      return false;
   }
   
   public List<String> getIncludeUrls() {
      return includeUrls;
   }
   public void setIncludeUrls(List<String> includeUrls) {
      this.includeUrls = includeUrls;
   }
}

後續更新XSS注入與越權等安全問題。