尝试上传时无效的CSRF令牌Spring 4 MVC

Question

我试图使用Spring MVC 4上传一个带有Web应用程序的文件，但是我收到一个错误：

在请求参数'_csrf'或标题'X-CSRF-TOKEN'上找到无效的CSRF令牌'null'。

春季版：

Spring版本4.1.7.RELEASE

Spring Security 4.0.1.RELEASE

码：

web.xml中

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
    version="2.4">

    <display-name>FATCA Web Application</display-name>

    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            /WEB-INF/spring-web-servlet.xml         
        </param-value>
    </context-param>

    <servlet>
        <servlet-name>spring-web</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>  

    <servlet-mapping>
        <servlet-name>spring-web</servlet-name>
        <url-pattern>*.html</url-pattern>
    </servlet-mapping>

</web-app>

弹簧网络servlet.xml中

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"
    xmlns:context="http://www.springframework.org/schema/context"
    xmlns:mvc="http://www.springframework.org/schema/mvc"
    xsi:schemaLocation="
        http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
        http://www.springframework.org/schema/context
        http://www.springframework.org/schema/context/spring-context-3.0.xsd
        http://www.springframework.org/schema/mvc
        http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd">

    <context:property-placeholder location="classpath:webapp.properties" />

    <context:annotation-config />

    <context:component-scan base-package="com.opessoftware" />

    <mvc:annotation-driven />

    <bean id="messageSource"
        class="org.springframework.context.support.ResourceBundleMessageSource">
        <property name="basename" value="messages" />
    </bean> 

    <bean id="viewResolver"
        class="org.springframework.web.servlet.view.InternalResourceViewResolver">
        <property name="viewClass"
            value="org.springframework.web.servlet.view.JstlView" />
        <property name="prefix">
            <value>/WEB-INF/views/</value>
        </property>
        <property name="suffix">
            <value>.jsp</value>
        </property>
    </bean>

</beans>

Settings.jsp

<form:form method="POST" action="uploadFile.html"
                            enctype="multipart/form-data" security="none">
                            <table style="width: 100%" border="1">
                                <tr>
                                    <td colspan="1" style="text-align: left"><input
                                        type="file" name="file" style="width: 100%;" /></td>
                                    <td colspan="1" style="text-align: left"><input
                                        type="submit" value=<spring:message code="uploadSettings" /> />
                                    </td>
                                </tr>
                            </table>
                        </form:form>

在提交包含字符串“Test”的名为test.txt的文件后发布请求有效内容：

Content-Type: multipart/form-data; boundary=---------------------------83935555814334632461054528816
Content-Length: 368

-----------------------------83935555814334632461054528816
Content-Disposition: form-data; name="file"; filename="test.txt"
Content-Type: text/plain

Test
-----------------------------83935555814334632461054528816
Content-Disposition: form-data; name="_csrf"

41f3dc0a-b97f-4dac-bc49-21e02be53818
-----------------------------83935555814334632461054528816--

Answer 1

我通过遵循Spring Security 3.2，CSRF和多部分请求 的接受答案的第二点中的一般建议来修复此问题 ，但使用Spring Security 4.0.1.RELEASE而不是版本3.2。

改变1

将Web应用程序从Servlet API 2.4更新为Servlet API 3.0 ：

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 
          http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
          version="3.0">
....
</web-app>

改变2

使用基于Java的配置，创建了一个StandardServletMultipartResolver ，它使用Servlet 3.0的多部分处理，不需要commons-fileupload 。 请注意，原始实现忽略了显式创建任何多部分解析器，尽管它在Maven项目中确实包含了依赖commons-fileupload 。

@Configuration
public class WebApplicationConfiguration {
    @Bean
    public MultipartResolver multipartResolver() {
        return new StandardServletMultipartResolver();
    }
}

改变3

在DispatcherServlet添加了“multipart-config”：

在web.xml ：

<servlet>
    <servlet-name>spring-web</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
    <multipart-config>
        <location>/tmp</location>
        <max-file-size>1000000</max-file-size>
        <max-request-size>1000000</max-request-size>
        <file-size-threshold>10000</file-size-threshold>
    </multipart-config>
</servlet>  

使用Java：

public class SecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {
    public SecurityWebApplicationInitializer() {
    super(SecurityConfiguration.class);
    }

    @Override
    protected void beforeSpringSecurityFilterChain(ServletContext servletContext) {
    final XmlWebApplicationContext appContext = new XmlWebApplicationContext();
    appContext.setConfigLocation("/WEB-INF/spring-web-servlet.xml");

    final ServletRegistration.Dynamic registration = servletContext.addServlet("dispatcher",
        new DispatcherServlet(appContext));
    registration.setLoadOnStartup(1);
    registration.addMapping("/");
    registration.setMultipartConfig(new MultipartConfigElement("", 1000000, 1000000, 100000));
    }
}

改变4

从Maven项目中删除了依赖项commons-fileupload 。