在一個(gè)spring boot項(xiàng)目中疙挺，需要防止CSRF攻擊，按理說(shuō)應(yīng)該集成spring security才對(duì)。
但是不想使工程變得太復(fù)雜，這時(shí)可以只把spring security中的相關(guān)filter引入來(lái)進(jìn)行油湖。
在pom中添加相關(guān)依賴(lài)
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-freemarker</artifactId>
</dependency>
<!-- Security (used for CSRF protection only) -->
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId>
</dependency>
</dependencies>
在app啟動(dòng)時(shí),添加CsrfFilter
@SpringBootApplication
public class Application extends WebMvcConfigurerAdapter {
@Bean
public FilterRegistrationBean csrfFilter() {
FilterRegistrationBean registration = new FilterRegistrationBean();
registration.setFilter(new CsrfFilter(new HttpSessionCsrfTokenRepository()));
registration.addUrlPatterns("/*");
return registration;
}
public static void main(String[] args) {
SpringApplication.run(Application.class, args);
}
}
form中添加CSRF的hidden字段
<input name="${(_csrf.parameterName)!}" value="${(_csrf.token)!}" type="hidden">
ajax中添加CSRF的頭
xhr.setRequestHeader("${_csrf.headerName}", "${_csrf.token}");
