Spring Security筆記：解決CsrfFilter與Rest服務Post方式的矛盾

基於Spring Security+Spring MVC的web應用，為了防止跨站提交攻擊，通常會配置csrf，即：

    <http ...>
        ...
        <csrf />        
    </http>

如果應用中有Post方式訪問的Rest服務(參考下面的代碼)，會很不幸的發現，所有POST方式請求的服務會調用失敗。

    @RequestMapping(value = "/user/create", method = RequestMethod.POST)
    @ResponseBody
    public UserInfo createUser(@RequestBody(required = true) UserInfo user,
            HttpServletRequest request, HttpServletResponse response)
            throws Exception {
        ...
    }

原因在於：啟用csrf后，所有http請求都被會CsrfFilter攔截，而CsrfFilter中有一個私有類DefaultRequiresCsrfMatcher

    private static final class DefaultRequiresCsrfMatcher implements RequestMatcher {
        private Pattern allowedMethods = Pattern.compile("^(GET|HEAD|TRACE|OPTIONS)$");

        /* (non-Javadoc)
         * @see org.springframework.security.web.util.matcher.RequestMatcher#matches(javax.servlet.http.HttpServletRequest)
         */
        public boolean matches(HttpServletRequest request) {
            return !allowedMethods.matcher(request.getMethod()).matches();
        }
    }

從這段源碼可以發現，POST方法被排除在外了，也就是說只有GET|HEAD|TRACE|OPTIONS這4類方法會被放行，其它Method的http請求，都要驗證_csrf的token是否正確，而通常post方式調用rest服務時，又沒有_csrf的token，所以校驗失敗。

解決方法：自己弄一個Matcher

package com.cnblogs.yjmyzz.utils;

import java.util.List;
import java.util.regex.Pattern;

import javax.servlet.http.HttpServletRequest;

import org.springframework.security.web.util.matcher.RequestMatcher;

public class CsrfSecurityRequestMatcher implements RequestMatcher {
    private Pattern allowedMethods = Pattern
            .compile("^(GET|HEAD|TRACE|OPTIONS)$");

    public boolean matches(HttpServletRequest request) {

        if (execludeUrls != null && execludeUrls.size() > 0) {
            String servletPath = request.getServletPath();
            for (String url : execludeUrls) {
                if (servletPath.contains(url)) {
                    return false;
                }
            }
        }
        return !allowedMethods.matcher(request.getMethod()).matches();
    }

    /**
     * 需要排除的url列表
     */
    private List<String> execludeUrls;

    public List<String> getExecludeUrls() {
        return execludeUrls;
    }

    public void setExecludeUrls(List<String> execludeUrls) {
        this.execludeUrls = execludeUrls;
    }
}

這里添加了一個屬性execludeUrls，允許人為排除哪些url。

然后在配置文件里，這樣修改：

    <http entry-point-ref="loginEntryPoint" use-expressions="true">
        ...
        <intercept-url pattern="/rest/**" access="permitAll" />
        ...
        <csrf request-matcher-ref="csrfSecurityRequestMatcher"/>        
    </http>
    
    <beans:bean id="csrfSecurityRequestMatcher" class="com.cnblogs.yjmyzz.utils.CsrfSecurityRequestMatcher">
        <beans:property name="execludeUrls">
            <beans:list>
                <beans:value>/rest/</beans:value>
            </beans:list>
        </beans:property>
    </beans:bean>

這里約定所有/rest/開頭的都是Rest服務地址，上面的配置就把/rest/排除在csrf驗證的范圍之外了.