---
# System prepended metadata

title: '[Java]如何用黑名單限制HTTP Method'
tags: [web.xml, Java]

---

#  [Java]如何用黑名單限制HTTP Method
###### tags: `Java` `web.xml`
到web.xml設定加入以下片段
*概念是允許沒有人可以使用列表中的method*
```
<security-constraint>
   <web-resource-collection>
      <url-pattern>/*</url-pattern>
      <http-method>PUT</http-method>
      <http-method>DELETE</http-method>
      <http-method>HEAD</http-method>
      <http-method>OPTIONS</http-method>
      <http-method>TRACE</http-method>
   </web-resource-collection>
   <auth-constraint>
   </auth-constraint>
</security-constraint>
```
web module3.0之後可以用正向寫法
```
<security-constraint>
    <web-resource-collection>
        <web-resource-name>forbidanMethod</web-resource-name>
        <url-pattern>/*</url-pattern>
        <http-method-omission>GET</http-method-omission>
        <http-method-omission>POST</http-method-omission>
    </web-resource-collection>
    <auth-constraint>
        <role-name>*</role-name>
    </auth-constraint>
</security-constraint>
```