SpringBoot2.0 url中出現特殊符號「帶括號{}'"等等」時會拋出400錯誤

訪問

http://127.0.0.1:8080/api?method=taxiong.goods.list&params={"page":1,"pageSize":10}

出現了如下錯誤

2018-08-09 21:39:28.915  INFO 6750 --- [nio-8080-exec-1] o.apache.coyote.http11.Http11Processor   : Error parsing HTTP request header
 Note: further occurrences of HTTP header parsing errors will be logged at DEBUG level.

java.lang.IllegalArgumentException: Invalid character found in the request target. The valid characters are defined in RFC 7230 and RFC 3986
    at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:479) ~[tomcat-embed-core-8.5.32.jar:8.5.32]
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:684) ~[tomcat-embed-core-8.5.32.jar:8.5.32]
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-8.5.32.jar:8.5.32]
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:800) [tomcat-embed-core-8.5.32.jar:8.5.32]
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1471) [tomcat-embed-core-8.5.32.jar:8.5.32]
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-8.5.32.jar:8.5.32]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [na:1.8.0_111]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [na:1.8.0_111]
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.5.32.jar:8.5.32]
    at java.lang.Thread.run(Thread.java:745) [na:1.8.0_111]

 

網上找了下，大概是這樣解釋的： 

這個問題是由於Tomcat的新版本中增加了一個新特性，就是嚴格按照 RFC 3986規范進行訪問解析，而 RFC 3986規范定義了Url中只允許包含英文字母（a-zA-Z）、數字（0-9）、-_.~4個特殊字符以及所有保留字符(RFC3986中指定了以下字符為保留字符：! * ’ ( ) ; : @ & = + $ , / ? # [ ])。

 

解決方案： 

　　① 可以客戶端請求時URL encode處理特殊字段

　　② 改用 post 請求 『由於我這是一個新服務在開發中，所以選用了這種方案』

　　③ 改 Tomcat 配置文件

　　　　http://tomcat.apache.org/tomcat-8.0-doc/config/systemprops.html#Other

　　　　官方描述如下

tomcat.util.http.parser.HttpParser. requestTargetAllow    
This system property is deprecated. Use the relaxedPathChars and relaxedQueryChars attributes of the Connector instead. These attributes permit a wider range of characters to be configured as valid.

A string comprised of characters the server should allow even when they are not encoded. These characters would normally result in a 400 status.

The acceptable characters for this property are: |, { , and }

WARNING: Use of this option may expose the server to CVE-2016-6816.

If not specified, the default value of null will be used.