码迷，mamicode.com
首页 > 编程语言 > 详细

Spring3.x通过配置来防范csrf攻击

时间：2015-10-16 15:36:04      阅读：358      评论：0      收藏：0      [点我收藏+]

标签：

1. [代码]CsrfTokenManager 用于管理csrfToken相关     

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
packagecom.uncle5.pubrub.web.common;
 
importjava.util.UUID;
 
importjavax.servlet.http.HttpServletRequest;
importjavax.servlet.http.HttpSession;
 
publicfinalclassCsrfTokenManager {
 
    // 隐藏域参数名称
    staticfinalString CSRF_PARAM_NAME ="CSRFToken";
 
    // session中csrfToken参数名称
    publicstaticfinalString CSRF_TOKEN_FOR_SESSION_ATTR_NAME = CsrfTokenManager.class
            .getName() +".tokenval";
 
    privateCsrfTokenManager() {
    };
 
    // 在session中创建csrfToken
    publicstaticString createTokenForSession(HttpSession session) {
        String token =null;
 
        synchronized(session) {
            token = (String) session
                    .getAttribute(CSRF_TOKEN_FOR_SESSION_ATTR_NAME);
            if(null== token) {
                token = UUID.randomUUID().toString();
                session.setAttribute(CSRF_TOKEN_FOR_SESSION_ATTR_NAME, token);
            }
        }
        returntoken;
    }
 
    publicstaticString getTokenFromRequest(HttpServletRequest request) {
        returnrequest.getParameter(CSRF_PARAM_NAME);
    }
}

2. [代码]CsrfRequestDataValueProcessor 自动创建hidden的csrfToken域的类     

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
packagecom.uncle5.pubrub.web.common;
 
importjava.util.Map;
 
importjavax.servlet.http.HttpServletRequest;
 
importorg.springframework.stereotype.Component;
importorg.springframework.web.servlet.support.RequestDataValueProcessor;
 
importcom.google.common.collect.Maps;
 
@Component("requestDataValueProcessor")
publicclassCsrfRequestDataValueProcessorimplementsRequestDataValueProcessor {
 
    @Override
    publicString processAction(HttpServletRequest request, String action) {
        // TODO 暂时原样返回action
        returnaction;
    }
 
    @Override
    publicString processFormFieldValue(HttpServletRequest request,
            String name, String value, String type) {
        // TODO 暂时原样返回value
        returnvalue;
    }
 
    @Override
    publicMap<String, String> getExtraHiddenFields(HttpServletRequest request) {
        //此处是当使用spring的taglib标签<form:form>创建表单时候，增加的隐藏域参数
        Map<String, String> hiddenFields = Maps.newHashMap();
        hiddenFields.put(CsrfTokenManager.CSRF_PARAM_NAME,
                CsrfTokenManager.createTokenForSession(request.getSession()));
 
        returnhiddenFields;
    }
 
    @Override
    publicString processUrl(HttpServletRequest request, String url) {
        // TODO 暂时原样返回url
        returnurl;
    }
 
}

3. [代码]CsrfInterceptor 对于post请求进行拦截，检测csrfToken是否匹配     

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
packagecom.uncle5.pubrub.web.security;
 
importjava.net.URLEncoder;
 
importjavax.servlet.http.HttpServletRequest;
importjavax.servlet.http.HttpServletResponse;
 
importorg.slf4j.Logger;
importorg.slf4j.LoggerFactory;
importorg.springframework.beans.factory.annotation.Autowired;
importorg.springframework.util.StringUtils;
importorg.springframework.web.servlet.handler.HandlerInterceptorAdapter;
 
importcom.uncle5.pubrub.web.common.CsrfTokenManager;
importcom.uncle5.pubrub.web.common.WebUser;
 
publicclassCsrfInterceptorextendsHandlerInterceptorAdapter {
 
    privatestaticfinalLogger logger = LoggerFactory
            .getLogger(CsrfInterceptor.class);
 
    @Autowired
    WebUser webUser;
 
    @Override
    publicbooleanpreHandle(HttpServletRequest request,
            HttpServletResponse response, Object handler)throwsException {
 
        if("POST".equalsIgnoreCase(request.getMethod())) {
            String CsrfToken = CsrfTokenManager.getTokenFromRequest(request);
            if(CsrfToken ==null
                    || !CsrfToken.equals(request.getSession().getAttribute(
                            CsrfTokenManager.CSRF_TOKEN_FOR_SESSION_ATTR_NAME))) {
                String reLoginUrl ="/login?backurl="
                        + URLEncoder.encode(getCurrentUrl(request),"utf-8");
 
                response.sendRedirect(reLoginUrl);
                returnfalse;
            }
        }
 
        returntrue;
    }
 
    privateString getCurrentUrl(HttpServletRequest request) {
        String currentUrl = request.getRequestURL().toString();
        if(!StringUtils.isEmpty(request.getQueryString())) {
            currentUrl +="?"+ request.getQueryString();
        }
 
        returncurrentUrl;
    }
}

4. [代码]springMVC 配置文件，增加需要进行拦截的url     

?
1
2
3
4
5
6
7
8
<!-- 安全拦截用的 -->
    <mvc:interceptors>
        <mvc:interceptor>
            <mvc:mappingpath="/forum/post"/>
            <mvc:mappingpath="/forum/reply/*"/>
            <beanclass="com.uncle5.pubrub.web.security.CsrfInterceptor"/>
        </mvc:interceptor>       
    </mvc:interceptors>

5. [代码]jsp页面，需要注意的是必须使用spring的form标签     

?
1
2
3
4
5
6
7
8
9
<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form"%>
 
<divstyle="margin: 0 auto; border: 1px solid orange; width: 80%; height: 400px;">
        <form:formaction="/forum/post"method="post">
            <span>标题:</span><inputtype="text"name="title"id="title">
            <textareaname="content"id="content"rows="30"cols="40"></textarea>
            <inputtype="submit"name="submit"value="submit">
        </form:form>
    </div>

6. [代码]jsp页面 查看源码会发现已经添加上了hidden字段     

?
1
2
3
4
5
6
7
8
<divstyle="margin: 0 auto; border: 1px solid orange; width: 80%; height: 400px;">
        <formid="command"action="/forum/post"method="post">
            <span>标题:</span><inputtype="text"name="title"id="title">
            <textareaname="content"id="content"rows="30"cols="40"></textarea>          
            <inputtype="submit"name="submit"value="submit">
        <inputtype="hidden"name="CSRFToken"value="35afec82-da7b-449e-9ae9-b38664b5af63"/>
</form>
    </div>

7. [代码]相关原理说明     

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
1.只有当使用spring的form标签时候，才会在渲染jsp页面时候触发
org.springframework.web.servlet.tags.form.FormTag 类中的
 
@Override
    publicintdoEndTag()throwsJspException {
        RequestDataValueProcessor processor = getRequestContext().getRequestDataValueProcessor();
        ServletRequest request =this.pageContext.getRequest();
        if((processor !=null) && (requestinstanceofHttpServletRequest)) {
            writeHiddenFields(processor.getExtraHiddenFields((HttpServletRequest) request));
        }
        this.tagWriter.endTag();
        returnEVAL_PAGE;
    }
该方法会调用上文中所说的CsrfRequestDataValueProcessor中的创建隐藏域的方法getExtraHiddenFields来创建csrfToken隐藏域。
 
2.对相关需要进行防范csrf攻击的post请求地址进行拦截，此处是依赖springMVC中提供的拦截器机制来操作的
<mvc:interceptors>
        <mvc:interceptor>
            <mvc:mapping path="/forum/post"/>
            <mvc:mapping path="/forum/reply/*"/>
            <beanclass="com.uncle5.pubrub.web.security.CsrfInterceptor"/>
        </mvc:interceptor>
    </mvc:interceptors>
当用户访问"/forum/post"这个请求时候，会直接进入CsrfInterceptor的preHandle方法，此处针对post请求

1. [代码]CsrfTokenManager 用于管理csrfToken相关     

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
packagecom.uncle5.pubrub.web.common;
 
importjava.util.UUID;
 
importjavax.servlet.http.HttpServletRequest;
importjavax.servlet.http.HttpSession;
 
publicfinalclassCsrfTokenManager {
 
    // 隐藏域参数名称
    staticfinalString CSRF_PARAM_NAME ="CSRFToken";
 
    // session中csrfToken参数名称
    publicstaticfinalString CSRF_TOKEN_FOR_SESSION_ATTR_NAME = CsrfTokenManager.class
            .getName() +".tokenval";
 
    privateCsrfTokenManager() {
    };
 
    // 在session中创建csrfToken
    publicstaticString createTokenForSession(HttpSession session) {
        String token =null;
 
        synchronized(session) {
            token = (String) session
                    .getAttribute(CSRF_TOKEN_FOR_SESSION_ATTR_NAME);
            if(null== token) {
                token = UUID.randomUUID().toString();
                session.setAttribute(CSRF_TOKEN_FOR_SESSION_ATTR_NAME, token);
            }
        }
        returntoken;
    }
 
    publicstaticString getTokenFromRequest(HttpServletRequest request) {
        returnrequest.getParameter(CSRF_PARAM_NAME);
    }
}

2. [代码]CsrfRequestDataValueProcessor 自动创建hidden的csrfToken域的类     

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
packagecom.uncle5.pubrub.web.common;
 
importjava.util.Map;
 
importjavax.servlet.http.HttpServletRequest;
 
importorg.springframework.stereotype.Component;
importorg.springframework.web.servlet.support.RequestDataValueProcessor;
 
importcom.google.common.collect.Maps;
 
@Component("requestDataValueProcessor")
publicclassCsrfRequestDataValueProcessorimplementsRequestDataValueProcessor {
 
    @Override
    publicString processAction(HttpServletRequest request, String action) {
        // TODO 暂时原样返回action
        returnaction;
    }
 
    @Override
    publicString processFormFieldValue(HttpServletRequest request,
            String name, String value, String type) {
        // TODO 暂时原样返回value
        returnvalue;
    }
 
    @Override
    publicMap<String, String> getExtraHiddenFields(HttpServletRequest request) {
        //此处是当使用spring的taglib标签<form:form>创建表单时候，增加的隐藏域参数
        Map<String, String> hiddenFields = Maps.newHashMap();
        hiddenFields.put(CsrfTokenManager.CSRF_PARAM_NAME,
                CsrfTokenManager.createTokenForSession(request.getSession()));
 
        returnhiddenFields;
    }
 
    @Override
    publicString processUrl(HttpServletRequest request, String url) {
        // TODO 暂时原样返回url
        returnurl;
    }
 
}

3. [代码]CsrfInterceptor 对于post请求进行拦截，检测csrfToken是否匹配     

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
packagecom.uncle5.pubrub.web.security;
 
importjava.net.URLEncoder;
 
importjavax.servlet.http.HttpServletRequest;
importjavax.servlet.http.HttpServletResponse;
 
importorg.slf4j.Logger;
importorg.slf4j.LoggerFactory;
importorg.springframework.beans.factory.annotation.Autowired;
importorg.springframework.util.StringUtils;
importorg.springframework.web.servlet.handler.HandlerInterceptorAdapter;
 
importcom.uncle5.pubrub.web.common.CsrfTokenManager;
importcom.uncle5.pubrub.web.common.WebUser;
 
publicclassCsrfInterceptorextendsHandlerInterceptorAdapter {
 
    privatestaticfinalLogger logger = LoggerFactory
            .getLogger(CsrfInterceptor.class);
 
    @Autowired
    WebUser webUser;
 
    @Override
    publicbooleanpreHandle(HttpServletRequest request,
            HttpServletResponse response, Object handler)throwsException {
 
        if("POST".equalsIgnoreCase(request.getMethod())) {
            String CsrfToken = CsrfTokenManager.getTokenFromRequest(request);
            if(CsrfToken ==null
                    || !CsrfToken.equals(request.getSession().getAttribute(
                            CsrfTokenManager.CSRF_TOKEN_FOR_SESSION_ATTR_NAME))) {
                String reLoginUrl ="/login?backurl="
                        + URLEncoder.encode(getCurrentUrl(request),"utf-8");
 
                response.sendRedirect(reLoginUrl);
                returnfalse;
            }
        }
 
        returntrue;
    }
 
    privateString getCurrentUrl(HttpServletRequest request) {
        String currentUrl = request.getRequestURL().toString();
        if(!StringUtils.isEmpty(request.getQueryString())) {
            currentUrl +="?"+ request.getQueryString();
        }
 
        returncurrentUrl;
    }
}

4. [代码]springMVC 配置文件，增加需要进行拦截的url     

?
1
2
3
4
5
6
7
8
<!-- 安全拦截用的 -->
    <mvc:interceptors>
        <mvc:interceptor>
            <mvc:mappingpath="/forum/post"/>
            <mvc:mappingpath="/forum/reply/*"/>
            <beanclass="com.uncle5.pubrub.web.security.CsrfInterceptor"/>
        </mvc:interceptor>       
    </mvc:interceptors>

5. [代码]jsp页面，需要注意的是必须使用spring的form标签     

?
1
2
3
4
5
6
7
8
9
<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form"%>
 
<divstyle="margin: 0 auto; border: 1px solid orange; width: 80%; height: 400px;">
        <form:formaction="/forum/post"method="post">
            <span>标题:</span><inputtype="text"name="title"id="title">
            <textareaname="content"id="content"rows="30"cols="40"></textarea>
            <inputtype="submit"name="submit"value="submit">
        </form:form>
    </div>

6. [代码]jsp页面 查看源码会发现已经添加上了hidden字段     

?
1
2
3
4
5
6
7
8
<divstyle="margin: 0 auto; border: 1px solid orange; width: 80%; height: 400px;">
        <formid="command"action="/forum/post"method="post">
            <span>标题:</span><inputtype="text"name="title"id="title">
            <textareaname="content"id="content"rows="30"cols="40"></textarea>          
            <inputtype="submit"name="submit"value="submit">
        <inputtype="hidden"name="CSRFToken"value="35afec82-da7b-449e-9ae9-b38664b5af63"/>
</form>
    </div>

7. [代码]相关原理说明     

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
1.只有当使用spring的form标签时候，才会在渲染jsp页面时候触发
org.springframework.web.servlet.tags.form.FormTag 类中的
 
@Override
    publicintdoEndTag()throwsJspException {
        RequestDataValueProcessor processor = getRequestContext().getRequestDataValueProcessor();
        ServletRequest request =this.pageContext.getRequest();
        if((processor !=null) && (requestinstanceofHttpServletRequest)) {
            writeHiddenFields(processor.getExtraHiddenFields((HttpServletRequest) request));
        }
        this.tagWriter.endTag();
        returnEVAL_PAGE;
    }
该方法会调用上文中所说的CsrfRequestDataValueProcessor中的创建隐藏域的方法getExtraHiddenFields来创建csrfToken隐藏域。
 
2.对相关需要进行防范csrf攻击的post请求地址进行拦截，此处是依赖springMVC中提供的拦截器机制来操作的
<mvc:interceptors>
        <mvc:interceptor>
            <mvc:mapping path="/forum/post"/>
            <mvc:mapping path="/forum/reply/*"/>
            <beanclass="com.uncle5.pubrub.web.security.CsrfInterceptor"/>
        </mvc:interceptor>
    </mvc:interceptors>
当用户访问"/forum/post"这个请求时候，会直接进入CsrfInterceptor的preHandle方法，此处针对post请求

Spring3.x通过配置来防范csrf攻击

标签：

原文地址：http://my.oschina.net/u/2249726/blog/517976
踩
(0)
赞
(0)
   
举报
评论 一句话评论（0）
登录后才能评论！
分享档案
更多>
2021年07月29日 (22)
2021年07月28日 (40)
2021年07月27日 (32)
2021年07月26日 (79)
2021年07月23日 (29)
2021年07月22日 (30)
2021年07月21日 (42)
2021年07月20日 (16)
2021年07月19日 (90)
2021年07月16日 (35)
周排行
mamicode.com排行更多图片
更多
友情链接
兰亭集智   国之画   百度统计   站长统计   阿里云   chrome插件   新版天听网
关于我们 - 联系我们 - 留言反馈
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码！