springboot項目防止CSRF攻擊

一、在pom中引入spring-security包

<!-- Security -->
<dependency>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-web</artifactId>
</dependency>

 

二、在app啟動時,添加CsrfFilter攔截

@SpringBootApplication
public class Application extends WebMvcConfigurerAdapter {

    @Bean
    public FilterRegistrationBean csrfFilter() {
        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setFilter(new CsrfFilter(new HttpSessionCsrfTokenRepository()));
        registration.addUrlPatterns("/search");//指定攔截路由,*表示全部攔截
　　　　 //registration.addUrlPatterns("/*");
        return registration;
    }

    public static void main(String[] args) {
        SpringApplication.run(Application.class, args);
    }
}

 

 

三、form表單提交增加隱藏字段

<input name="${(_csrf.parameterName)!}" value="${(_csrf.token)!}" type="hidden">

 

四、ajax請求時填加CSRF的頭

xhr.setRequestHeader("${_csrf.headerName}", "${_csrf.token}");