SpringSecurity的防Csrf攻擊實(shí)現(xiàn)代碼解析

public final class CsrfFilter extends OncePerRequestFilter {
 public static final RequestMatcher DEFAULT_CSRF_MATCHER = new
   CsrfFilter.DefaultRequiresCsrfMatcher();
 private final Log logger = LogFactory.getLog(this.getClass());
 private final CsrfTokenRepository tokenRepository;
 private RequestMatcher requireCsrfProtectionMatcher;
 private AccessDeniedHandler accessDeniedHandler;
 public CsrfFilter(CsrfTokenRepository csrfTokenRepository) {
  this.requireCsrfProtectionMatcher = DEFAULT_CSRF_MATCHER;
  this.accessDeniedHandler = new AccessDeniedHandlerImpl();
  Assert.notNull(csrfTokenRepository, "csrfTokenRepository cannot be null");
  this.tokenRepository = csrfTokenRepository;
 }
 //通過這里可以看出SpringSecurity的csrf機(jī)制把請(qǐng)求方式分成兩類來處理
 protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
         FilterChain filterChain) throws ServletException, IOException {
  request.setAttribute(HttpServletResponse.class.getName(), response);
  CsrfToken csrfToken = this.tokenRepository.loadToken(request);
  boolean missingToken = csrfToken == null;
  if (missingToken) {
   csrfToken = this.tokenRepository.generateToken(request);
   this.tokenRepository.saveToken(csrfToken, request, response);
  }
  request.setAttribute(CsrfToken.class.getName(), csrfToken);
  request.setAttribute(csrfToken.getParameterName(), csrfToken);
//第一類："GET", "HEAD", "TRACE", "OPTIONS"四類請(qǐng)求可以直接通過
  if (!this.requireCsrfProtectionMatcher.matches(request)) {
   filterChain.doFilter(request, response);
  } else {
//第二類：除去上面四類，包括POST都要被驗(yàn)證攜帶token才能通過
   String actualToken = request.getHeader(csrfToken.getHeaderName());
   if (actualToken == null) {
    actualToken = request.getParameter(csrfToken.getParameterName());
   }
   if (!csrfToken.getToken().equals(actualToken)) {
    if (this.logger.isDebugEnabled()) {
     this.logger.debug("Invalid CSRF token found for " +
       UrlUtils.buildFullRequestUrl(request));
    }
    if (missingToken) {
     this.accessDeniedHandler.handle(request, response, new
       MissingCsrfTokenException(actualToken));
    } else {
     this.accessDeniedHandler.handle(request, response, new
       InvalidCsrfTokenException(csrfToken, actualToken));
    }
   } else {
    filterChain.doFilter(request, response);
   }
  }
 }
 public void setRequireCsrfProtectionMatcher(RequestMatcher requireCsrfProtectionMatcher) {
  Assert.notNull(requireCsrfProtectionMatcher, "requireCsrfProtectionMatcher cannot be
  null");
  this.requireCsrfProtectionMatcher = requireCsrfProtectionMatcher;
 }
 public void setAccessDeniedHandler(AccessDeniedHandler accessDeniedHandler) {
  Assert.notNull(accessDeniedHandler, "accessDeniedHandler cannot be null");
  this.accessDeniedHandler = accessDeniedHandler;
 }
 private static final class DefaultRequiresCsrfMatcher implements RequestMatcher {
  private final HashSet<String> allowedMethods;
  private DefaultRequiresCsrfMatcher() {
   this.allowedMethods = new HashSet(Arrays.asList("GET", "HEAD", "TRACE", "OPTIONS"));
 }
  public boolean matches(HttpServletRequest request) {
   return !this.allowedMethods.contains(request.getMethod());
  }
 }
}

@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {

@Override
protected void configure(HttpSecurity http) throws Exception {
 http
//關(guān)閉打開的csrf保護(hù)
 .csrf().disable();
}
}

public interface CsrfToken extends Serializable {
 String getHeaderName();
 String getParameterName();
 String getToken();
}
//CsrfTokenRepository則定義了如何生成、保存以及加載CsrfToken。
public interface CsrfTokenRepository {
 CsrfToken generateToken(HttpServletRequest request);
 void saveToken(CsrfToken token, HttpServletRequest request,
     HttpServletResponse response);
 CsrfToken loadToken(HttpServletRequest request);
}

<input type='hidden' name='${_csrf.parameterName}' value='${_csrf.token}'>

@Override
 protected void doFilterInternal(HttpServletRequest request,
   HttpServletResponse response, FilterChain filterChain)
     throws ServletException, IOException {
  request.setAttribute(HttpServletResponse.class.getName(), response);
    
    //獲取到cookie中的csrf Token（CookieTokenRepository）或者從session中獲?。℉ttpSessionCsrfTokenRepository）
  CsrfToken csrfToken = this.tokenRepository.loadToken(request);
  final boolean missingToken = csrfToken == null;
    //加載不到，則證明請(qǐng)求是首次發(fā)起的，應(yīng)該生成并保存一個(gè)新的 CsrfToken 值
  if (missingToken) {
   csrfToken = this.tokenRepository.generateToken(request);
   this.tokenRepository.saveToken(csrfToken, request, response);
  }
  request.setAttribute(CsrfToken.class.getName(), csrfToken);
  request.setAttribute(csrfToken.getParameterName(), csrfToken);

    //排除部分不需要驗(yàn)證CSRF攻擊的請(qǐng)求方法（默認(rèn)忽略了GET、HEAD、TRACE和OPTIONS）
  if (!this.requireCsrfProtectionMatcher.matches(request)) {
   filterChain.doFilter(request, response);
   return;
  }

    //實(shí)際的token從header或者parameter中獲取
  String actualToken = request.getHeader(csrfToken.getHeaderName());
  if (actualToken == null) {
   actualToken = request.getParameter(csrfToken.getParameterName());
  }
  if (!csrfToken.getToken().equals(actualToken)) {
   if (this.logger.isDebugEnabled()) {
    this.logger.debug("Invalid CSRF token found for "
      + UrlUtils.buildFullRequestUrl(request));
   }
   if (missingToken) {
    this.accessDeniedHandler.handle(request, response,
      new MissingCsrfTokenException(actualToken));
   }
   else {
    this.accessDeniedHandler.handle(request, response,
      new InvalidCsrfTokenException(csrfToken, actualToken));
   }
   return;
  }

  filterChain.doFilter(request, response);
 }

//代碼如下：
.and().csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())

<form action="/executeLogin" method="post">
<p>Sign in to continue</p>
<div class="lowin-group">
 <label>用戶名 <a href="#" rel="external nofollow" rel="external nofollow" class="login-back-link">Sign in?</a></label>
 <input type="text" name="username" class="lowin-input">
</div>
<div class="lowin-group password-group">
 <label>密碼 <a href="#" rel="external nofollow" rel="external nofollow" class="forgot-link">Forgot Password?</a></label>
 <input type="password" name="password" class="lowin-input">
</div>
<div class="lowin-group">
 <label>驗(yàn)證碼</label>
 <input type="text" name="kaptcha" class="lowin-input">
 <img src="/kaptcha.jpg" alt="kaptcha" height="50px" width="150px" >
</div>
<div class="lowin-group">
 <label>記住我</label>
 <input name="remember-me" type="checkbox" value="true" />
</div>
<input type="hidden" name="_csrf">
<input class="lowin-btn login-btn" type="submit">
</form>
 <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js"></script> 
<script>
 $(function () {
  var aCookie = document.cookie.split("; ");
  console.log(aCookie);
  for (var i=0; i < aCookie.length; i++)
  {
   var aCrumb = aCookie[i].split("=");
   if ("XSRF-TOKEN" == aCrumb[0])
    $("input[name='_csrf']").val(aCrumb[1]);
  }
 });
</script>

private static final class DefaultRequiresCsrfMatcher implements RequestMatcher {
  private final HashSet<String> allowedMethods = new HashSet<>(
    Arrays.asList("GET", "HEAD", "TRACE", "OPTIONS"));
  @Override
  public boolean matches(HttpServletRequest request) {
   return !this.allowedMethods.contains(request.getMethod());
  }
 }