没有 jsp 的 csrf 令牌（spring mvc）

Question

I enabled csrf token in config of Spring security. But how mobile device recieve csrf token? When I had jsp, it looked like:

<input type='hidden' name='${_csrf.parameterName}' value='${_csrf.token}'/>

But now I have no jsp... so any way to send csrf manually?

Answer 1

A popular practice is to code a filter to attach the token as a cookie. Your client then sends a GET request first to fetch that cookie. For the subsequent requests, that cookie is then sent back as a header.

You can look at the official Spring Angular guide , and refer to Spring Lemon 's source code for a detailed implementation.

Answer 2

You could implement a stateless CSRF protection. One solution nicely explained by Robbert van Waveren is to have the clients generate and send the same unique secret value in both a Cookie and a custom HTTP header :

Considering a website is only allowed to read/write a Cookie for its own domain, only the real site can send the same value in both headers. Using this approach all your server has to do is check if both values are equal, on a stateless per request basis!

Answer 3

You may obtain it by looking inside of the _csrf attribute.

import javax.servlet.http.HttpServletRequest;
import org.springframework.security.web.csrf.CsrfToken;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/csrf_token")
public class CsrfTokenController {
    @GetMapping
    public String getToken(HttpServletRequest request) {
        CsrfToken token = (CsrfToken) request.getAttribute("_csrf");

        return token.getToken();
    }
}

Answer 4

If CSRF is enabled, you have to include a _csrf.token in the page you want to login or logout. Otherwise, both login and logout function will be failed.

Refer this for more help.

EDIT: You can get csrf token from request and send it according to your need. I have shared two references for csrf token please go through them. It will help you.

First Ref
Second Ref