如何找到CSRF令牌是否有效

Question

I am Using springs-security.xml inOrder to configure csrf token. The csrf token is by defualt enabled. Even though I manually enabled csrf token in configuration file.This is my configuration file.

springs-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:security="http://www.springframework.org/schema/security"
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
            http://www.springframework.org/schema/beans/spring-beans-4.2.xsd
            http://www.springframework.org/schema/security 
            http://www.springframework.org/schema/security/spring-security-4.0.xsd">

    <security:http  auto-config="true">
    <security:access-denied-handler error-page="/denied"/>
        <security:form-login login-page="/login"
        username-parameter="j_username"
        password-parameter="j_password"
        login-processing-url="/j_spring_security_check"
        authentication-failure-url="/login?failed=true" 
        default-target-url="/Hello" always-use-default-target="true"/>
        <!-- <security:custom-filter ref="secfilter" before="FILTER_SECURITY_INTERCEPTOR" /> -->
        <security:logout invalidate-session="false" logout-url="/j_spring_security_logout" logout-success-url="/logout"/>
         <security:csrf /> 
         <security:headers>
            <security:frame-options disabled="true"/>
         </security:headers>
    </security:http>

Jsp

<input type="hidden" name="${_csrf.parameterName}"
        value="${_csrf.token}" />
    <input type="hidden" id="parameterName" value="${_csrf.parameterName}" />
    <input type="hidden" id="token" value="${_csrf.token}" />

Those are my configuration files.

I am using Ajax call to communicate with server side.

return $http({
        url: 'getCity?' + angular.element('#parameterName').val() + '=' + angular.element('#token').val(),
        method: "POST"
    })

Here I want to test whether csrf is working or not.How can I test.

Answer 1

A couple of ways you can test it:

• Open the developer tools in your browser find the input element for the CSRF token and edit the token value. Trigger a POST submission. This should cause an error, HTTP status 403 typically.
• If you are running in a Tomcat or equivalent, you can login to the "Manager" webapp, find your session, edit or remove the CSRF token of your session. Then trigger a POST submission. This should cause an error.
• Of course a correct CSRF token should not cause error.