Tomcat9接收POST请求报错：请求目标含非法字符，如何处理？

报错信息 #

java.lang.IllegalArgumentException: Invalid character found in the request target [/t?personId=1308338881684471809&name=0xe40xbd0x950xe50xa40xa70xe70x840xb1&type=face_0&time=1716555197143]. The valid characters are defined in RFC 7230 and RFC 3986
    at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:486) ~[tomcat-embed-core-9.0.38.jar:9.0.38]
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:261) ~[tomcat-embed-core-9.0.38.jar:9.0.38]
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) [tomcat-embed-core-9.0.38.jar:9.0.38]
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868) [tomcat-embed-core-9.0.38.jar:9.0.38]
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1590) [tomcat-embed-core-9.0.38.jar:9.0.38]
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-9.0.38.jar:9.0.38]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_251]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_251]
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-9.0.38.jar:9.0.38]
    at java.lang.Thread.run(Thread.java:748) [na:1.8.0_251]

已尝试的配置 #

在启动类中添加Tomcat连接器自定义配置，但问题未解决：

@Bean
public ConfigurableServletWebServerFactory webServerFactory() {
    TomcatServletWebServerFactory fa = new TomcatServletWebServerFactory();
    fa.addConnectorCustomizers(connector -> {
//                        connector.setProperty("relaxedQueryChars", "[]{}");
        connector.setProperty("relaxedPathChars", "\"#<>[\\]^`{|}%,");
        connector.setProperty("relaxedQueryChars", "\"#<>[\\]^`{|}%,");

    });

    return fa;
}

问题背景 #

• 发送端代码无法修改，仅能调整接收端配置
• 抓包确认请求URL中存在特殊字符（name参数为0xe40xbd0x950xe50xa40xa70xe70x840xb1格式的十六进制UTF-8字节序列）
• 服务器为Tomcat 9.0.38，已配置spring.http.encoding.charset和server.tomcat.url-encoding.charset为UTF-8

可行解决方案 #

方案1：完善代码中的Tomcat连接器配置 #

在现有配置基础上，增加URI编码支持和非ASCII字符允许配置，同时扩展放松的字符范围：

@Bean
public ConfigurableServletWebServerFactory webServerFactory() {
    TomcatServletWebServerFactory factory = new TomcatServletWebServerFactory();
    factory.addConnectorCustomizers(connector -> {
        // 扩展放松的字符范围，覆盖请求中出现的特殊格式字符
        connector.setProperty("relaxedPathChars", "\"#<>[\\]^`{|}%,0x");
        connector.setProperty("relaxedQueryChars", "\"#<>[\\]^`{|}%,0x");
        // 开启URI的UTF-8编码解析
        connector.setProperty("URIEncoding", "UTF-8");
        connector.setProperty("useBodyEncodingForURI", "true");
        // 允许请求行包含非ASCII字符，适配直接传入UTF-8字节的场景
        connector.setProperty("allowNonAscii", "true");
    });
    return factory;
}

方案2：通过配置文件简化配置 #

使用Spring Boot配置文件（application.properties）替代代码Bean配置，直接添加以下参数：

# URI编码设置
server.tomcat.uri-encoding=UTF-8
server.tomcat.use-body-encoding-for-uri=true
# 允许请求行包含非ASCII字符
server.tomcat.allow-non-ascii=true
# 放松查询参数的字符限制
server.tomcat.relaxed-query-chars=",#<>[\]^`{|}%,0x"
# 放松路径字符限制（若路径中也存在特殊字符）
server.tomcat.relaxed-path-chars=",#<>[\]^`{|}%,0x"

方案3：自定义Tomcat请求解析逻辑（极端场景） #

若上述方案均无效，可通过自定义Tomcat的Http11InputBuffer子类修改请求行的字符校验逻辑，但该方式需深入Tomcat源码，仅推荐作为最后手段。

内容的提问来源于stack exchange，提问作者S D