CSRF 详解：攻击，防御，Spring Security应用等( 五 ) _CSRF

Spring Security - 默认对哪些Method拦截呢?"GET", "HEAD", "TRACE", "OPTIONS" 不会拦截：
private static final class DefaultRequiresCsrfMatcher implements RequestMatcher {private final HashSet<String> allowedMethods = new HashSet<String>(Arrays.asList("GET", "HEAD", "TRACE", "OPTIONS"));/** (non-Javadoc)** @see* org.springframework.security.web.util.matcher.RequestMatcher#matches(javax.* servlet.http.HttpServletRequest)*/@Overridepublic boolean matches(HttpServletRequest request) {return !this.allowedMethods.contains(request.getMethod());}}Spring Security - HttpSessionCsrfTokenRepository经过上面的分析，你再看Session的，是不是很简单? 我这边贴个代码，你眼睛扫一下即可。@pdai
public final class HttpSessionCsrfTokenRepository implements CsrfTokenRepository {private static final String DEFAULT_CSRF_PARAMETER_NAME = "_csrf";private static final String DEFAULT_CSRF_HEADER_NAME = "X-CSRF-TOKEN";private static final String DEFAULT_CSRF_TOKEN_ATTR_NAME = HttpSessionCsrfTokenRepository.class.getName().concat(".CSRF_TOKEN");private String parameterName = DEFAULT_CSRF_PARAMETER_NAME;private String headerName = DEFAULT_CSRF_HEADER_NAME;private String sessionAttributeName = DEFAULT_CSRF_TOKEN_ATTR_NAME;/** (non-Javadoc)** @see org.springframework.security.web.csrf.CsrfTokenRepository#saveToken(org.* springframework .security.web.csrf.CsrfToken,* javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)*/public void saveToken(CsrfToken token, HttpServletRequest request,HttpServletResponse response) {if (token == null) {HttpSession session = request.getSession(false);if (session != null) {session.removeAttribute(this.sessionAttributeName);}}else {HttpSession session = request.getSession();session.setAttribute(this.sessionAttributeName, token);}}/** (non-Javadoc)** @see* org.springframework.security.web.csrf.CsrfTokenRepository#loadToken(javax.servlet* .http.HttpServletRequest)*/public CsrfToken loadToken(HttpServletRequest request) {HttpSession session = request.getSession(false);if (session == null) {return null;}return (CsrfToken) session.getAttribute(this.sessionAttributeName);}/** (non-Javadoc)** @see org.springframework.security.web.csrf.CsrfTokenRepository#generateToken(javax.* servlet .http.HttpServletRequest)*/public CsrfToken generateToken(HttpServletRequest request) {return new DefaultCsrfToken(this.headerName, this.parameterName,createNewToken());}}Spring Security - 设置Csrf不对会造成哪些错误呢?

403 - 用CSRF作为控制权限，引发权限问题

There was an unexpected error (type=Forbidden, status=403).Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-XSRF-TOKEN'.

405 - 前置的参数绑定问题

POST method not supported 。// 本质上还是参数绑定时，Csrf没有设置或者不正确。总结与展望可见，CSRF 是一种危害非常大的攻击，又很难以防范。目前几种防御策略虽然可以很大程度上抵御 CSRF 的攻击，但并没有一种完美的解决方案。一些新的方案正在研究之中，比如对于每次请求都使用不同的动态口令，把 Referer 和 token 方案结合起来，甚至尝试修改 HTTP 规范，但是这些新的方案尚不成熟，要正式投入使用并被业界广为接受还需时日。在这之前，我们只有充分重视 CSRF，根据系统的实际情况选择最合适的策略，这样才能把 CSRF 的危害降到最低。