详解利用spring-security解决CSRF问题

<properties> 
    <spring.security.version>4.2.2.RELEASE</spring.security.version> 
  </properties> 
<dependency> 
        <groupId>org.springframework.security</groupId> 
        <artifactId>spring-security-core</artifactId> 
        <version>${spring.security.version}</version> 
      </dependency> 
 
      <dependency> 
        <groupId>org.springframework.security</groupId> 
        <artifactId>spring-security-web</artifactId> 
        <version>${spring.security.version}</version> 
      </dependency> 
 
      <dependency> 
        <groupId>org.springframework.security</groupId> 
        <artifactId>spring-security-config</artifactId> 
        <version>${spring.security.version}</version> 
      </dependency> 

<filter> 
    <filter-name>springSecurityFilterChain</filter-name> 
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> 
  </filter> 
 
  <filter-mapping> 
    <filter-name>springSecurityFilterChain</filter-name> 
    <url-pattern>/*</url-pattern> 
  </filter-mapping> 

<bean id="csrfSecurityRequestMatcher" class="com.xxx.CsrfSecurityRequestMatcher"></bean> 
 
  <security:http auto-config="true" use-expressions="true"> 
    <security:headers> 
      <security:frame-options disabled="true"/> 
    </security:headers> 
    <security:csrf request-matcher-ref="csrfSecurityRequestMatcher" /> 
  </security:http> 

private static final class DefaultRequiresCsrfMatcher implements RequestMatcher { 
    private final HashSet<String> allowedMethods; 
 
    private DefaultRequiresCsrfMatcher() { 
      this.allowedMethods = new HashSet(Arrays.asList(new String[]{"GET", "HEAD", "TRACE", "OPTIONS"})); 
    } 
 
    public boolean matches(HttpServletRequest request) { 
      return !this.allowedMethods.contains(request.getMethod()); 
    } 
  } 

public class CsrfSecurityRequestMatcher implements RequestMatcher { 
  private Pattern allowedMethods = Pattern.compile("^(GET|HEAD|TRACE|OPTIONS)$"); 
  private RegexRequestMatcher unprotectedMatcher = new RegexRequestMatcher("^/rest/.*", null); 
 
  @Override 
  public boolean matches(HttpServletRequest request) { 
    if(allowedMethods.matcher(request.getMethod()).matches()){ 
      return false; 
    } 
 
    return !unprotectedMatcher.matches(request); 
  } 
} 

<meta name="_csrf" content="${_csrf.token}"/> 
<meta name="_csrf_header" content="${_csrf.headerName}"/> 
 
<script> 
 
  var token = $("meta[name='_csrf']").attr("content"); 
  var header = $("meta[name='_csrf_header']").attr("content"); 
  $.ajaxSetup({ 
    beforeSend: function (xhr) { 
      if(header && token ){ 
        xhr.setRequestHeader(header, token); 
      } 
    }} 
  ); 
</script> 

protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { 
    request.setAttribute(HttpServletResponse.class.getName(), response); 
    CsrfToken csrfToken = this.tokenRepository.loadToken(request); 
    boolean missingToken = csrfToken == null; 
    if(missingToken) {//如果token为空，说明第一次访问，生成一个token对象 
      csrfToken = this.tokenRepository.generateToken(request); 
      this.tokenRepository.saveToken(csrfToken, request, response); 
    } 
 
    request.setAttribute(CsrfToken.class.getName(), csrfToken); 
    //把token对象放到request中，注意这里key是csrfToken.getParameterName()= _csrf，所以我们页面上才那么写死。 
    request.setAttribute(csrfToken.getParameterName(), csrfToken); 
     
    //这个macher就是我们在Spring配置文件中自定义的过滤器，也就是GET，HEAD, TRACE, OPTIONS和我们的rest都不处理 
    if(!this.requireCsrfProtectionMatcher.matches(request)) { 
      filterChain.doFilter(request, response); 
    } else { 
      String actualToken = request.getHeader(csrfToken.getHeaderName()); 
      if(actualToken == null) { 
        actualToken = request.getParameter(csrfToken.getParameterName()); 
      } 
 
      if(!csrfToken.getToken().equals(actualToken)) { 
        if(this.logger.isDebugEnabled()) { 
          this.logger.debug("Invalid CSRF token found for " + UrlUtils.buildFullRequestUrl(request)); 
        } 
 
        if(missingToken) { 
          this.accessDeniedHandler.handle(request, response, new MissingCsrfTokenException(actualToken)); 
        } else { 
          this.accessDeniedHandler.handle(request, response, new InvalidCsrfTokenException(csrfToken, actualToken)); 
        } 
 
      } else { 
        filterChain.doFilter(request, response); 
      } 
    } 
  }