CSRFGuard Javascript注入不起作用

Question

What am I doing wrong? I can't get the javascript injection to work. Here is what I put in my web.xml:

<listener>
    <listener-class>org.owasp.csrfguard.CsrfGuardServletContextListener</listener-class>
</listener>
<listener>
    <listener-class>org.owasp.csrfguard.CsrfGuardHttpSessionListener</listener-class>
</listener>
    <context-param>
        <param-name>Owasp.CsrfGuard.Config</param-name>
        <param-value>WEB-INF/csrfguard.properties</param-value>
    </context-param>
    <context-param>
        <param-name>Owasp.CsrfGuard.Config.Print</param-name>
        <param-value>true</param-value>
    </context-param>
    <filter>
        <filter-name>CSRFGuard</filter-name>
        <filter-class>org.owasp.csrfguard.CsrfGuardFilter</filter-class>
    </filter>
<filter-mapping>
    <filter-name>CSRFGuard</filter-name> 
    <url-pattern>/*</url-pattern>
</filter-mapping>
<servlet>
    <servlet-name>JavaScriptServlet</servlet-name>
    <servlet-class>org.owasp.csrfguard.servlet.JavaScriptServlet</servlet-class>
</servlet>
<servlet-mapping>
    <servlet-name>JavaScriptServlet</servlet-name>
    <url-pattern>/JavaScriptServlet</url-pattern>
</servlet-mapping>

In my jsp files, I add this line:

<script src="/JavaScriptServlet"></script>

But when I submit, the token doesn't get added to the request. I stepped through the code, and this line in CsrfGuard.verifySessionToken(request) returns null:

String tokenFromRequest = request.getParameter(getTokenName());

The only thing I can do so far is to add the token by using the CSRF custom tag and adding a hidden field to the form ala:

<input type="hidden" name="<csrf:tokenname/>" value="<csrf:tokenvalue/>"/>

Answer 1

It looks like I had to figure out what my servlet context root was first. Then I fixed it by changing

<script src="/JavaScriptServlet"></script>

to

<script src="/[servletcontextroot]/JavaScriptServlet"></script>

Answer 2

就我而言，在设置基本路径后添加脚本标签时，它工作正常。