2.访问控制列表（ACL）：创建和维护可访问API的用户列表，只允许在此列表中的用户访问API。这可以防止未经授权的用户通过Swagger API访问API端点。
3.API端点限制：限制对敏感或特权API端点的访问。例如，只允许具有特定权限的用户或角色访问这些端点。
4.API文档安全：确保Swagger API文档本身是受保护的，并且只有经过身份验证和授权的用户才能访问。这可以防止攻击者通过查看Swagger文档来发现未授权的API。
5.定期漏洞扫描：定期对API进行漏洞扫描和安全性测试，以便及时发现和修复任何可能存在的未授权访问漏洞。
/api-docs/swagger.json
/api.html
/api/api-docs
/api/apidocs
/api/doc
/api/swagger
/api/swagger-ui
/api/swagger-ui.html
/api/swagger-ui.html/
/api/swagger-ui.json
/api/swagger.json
/api/swagger/
/api/swagger/ui
/api/swagger/ui/
/api/swaggerui
/api/swaggerui/
/api/v1/
/api/v1/api-docs
/api/v1/apidocs
/api/v1/swagger
/api/v1/swagger-ui
/api/v1/swagger-ui.html
/api/v1/swagger-ui.json
/api/v1/swagger.json
/api/v1/swagger/
/api/v2
/api/v2/api-docs
/api/v2/apidocs
/api/v2/swagger
/api/v2/swagger-ui
/api/v2/swagger-ui.html
/api/v2/swagger-ui.json
/api/v2/swagger.json
/api/v2/swagger/
/api/v3
/apidocs
/apidocs/swagger.json
/doc.html
/docs/
/druid/index.html
/graphql
/libs/swaggerui
/libs/swaggerui/
/spring-security-oauth-resource/swagger-ui.html
/spring-security-rest/api/swagger-ui.html
/sw/swagger-ui.html
/swagger
/swagger-resources
/swagger-resources/configuration/security
/swagger-resources/configuration/security/
/swagger-resources/configuration/ui
/swagger-resources/configuration/ui/
/swagger-ui
/swagger-ui.html
/swagger-ui.html#/api-memory-controller
/swagger-ui.html/
/swagger-ui.json
/swagger-ui/swagger.json
/swagger.json
/swagger.yml
/swagger/
/swagger/index.html
/swagger/static/index.html
/swagger/swagger-ui.html
/swagger/ui/
/Swagger/ui/index
/swagger/ui/index
/swagger/v1/swagger.json
/swagger/v2/swagger.json
/template/swagger-ui.html
/user/swagger-ui.html
/user/swagger-ui.html/
/v1.x/swagger-ui.html
/v1/api-docs
/v1/swagger.json
/v2/api-docs
/v3/api-docs
1、添加Swagger依赖：在pom.xml文件中，添加Swagger的依赖项。
<dependency><groupId>io.springfox</groupId><artifactId>springfox-swagger2</artifactId><version>2.9.2</version></dependency><dependency><groupId>io.springfox</groupId><artifactId>springfox-swagger-ui</artifactId><version>2.9.2</version></dependency>
@Configuration@EnableSwagger2publicclassSwaggerConfig{@Beanpublic Docket api(){returnnew Docket(DocumentationType.SWAGGER_2).select().apis(RequestHandlerSelectors.basePackage("com.example.controller")).paths(PathSelectors.any()).build();}}
3、添加访问控制：
@Configuration@EnableSwagger2publicclassSwaggerConfig{@Beanpublic Docket api(){returnnew Docket(DocumentationType.SWAGGER_2).select().apis(RequestHandlerSelectors.basePackage("com.example.controller")).paths(PathSelectors.any()).build().securitySchemes(Arrays.asList(apiKey())).securityContexts(Arrays.asList(securityContext()));}private ApiKey apiKey(){returnnew ApiKey("apiKey", "api_key", "header");}private SecurityContext securityContext(){return SecurityContext.builder().securityReferences(defaultAuth()).forPaths(PathSelectors.any()).build();}List<SecurityReference> defaultAuth(){AuthorizationScope authorizationScope = new AuthorizationScope("global", "accessEverything");AuthorizationScope[] authorizationScopes = new AuthorizationScope[1];authorizationScopes[0] = authorizationScope;return Arrays.asList(new SecurityReference("apiKey", authorizationScopes));}}
4、配置Spring Security：如果应用程序中使用了Spring Security，请确保其已正确配置，以合理地允许或拒绝对Swagger API的访问。例如，可以根据用户角色或权限来配置Spring Security规则，从而实现精准的访问控制。
原文始发于微信公众号（EBCloud）：swagger-api未授权访问漏洞及防治方法
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论