HDIV + Spring Security 4：HDIV_PARAMETER_DOES_NOT_EXIST

Question

我有一个运行良好的Spring 4 MVC + Security应用程序。

我正在尝试将HDIV与之集成在一起，并且已经通过文档和展示示例进行了浏览： https : //github.com/hdiv/hdiv-spring-mvc-showcase/

当我使用preventValidationInUrlsWithoutParams = true时，一切正常，直到没有参数为止（很明显）。

当我删除该部分时，它只会使我进入“安全错误页面”。 我尝试调试，发现Spring Security已成功通过身份验证- 但是HDIV抛出HDIV_PARAMETER DO EX NOT EXIST 错误-这是我在日志中所拥有的：

 2016-07-27 08:24:34 [http-apr-8080-exec-5] INFO org.hdiv.logs.Logger - HDIV_PARAMETER_DOES_NOT_EXIST;/EmployeePortal/modules/dashboard.htm;177622190;;;127.0.0.1;127.0.0.1;MALLIKAM; 

显然，我知道该页面从那里的编号中找到了HDIV_STATE，但找不到CSRF？ （我假设3个分号与HDIV试图找到的某个参数有关，并且该参数为CSRF？）

另外，我还能在索引页面上看到生成的csrf（这使我怀疑是否正确设置了HDIV，因为上次尝试时，所有隐藏字段的显示方式都会不同-空白或为0，如果我没记错的话。）

如果是这样，我想知道为什么以及如何解决？

这是我到目前为止的内容：

web.xml

  <context-param> <param-name>contextConfigLocation</param-name> <param-value>/WEB-INF/applicationContext.xml, /WEB-INF/spring-security.xml, /WEB-INF/hdiv-config.xml, ...</param-value> </context-param> <listener> <listener-class> org.springframework.web.context.ContextLoaderListener </listener-class> </listener> <!-- For HTTPSession events --> <listener> <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class> </listener> <!-- HDIV Listener --> <listener> <listener-class>org.hdiv.listener.InitListener</listener-class> </listener> <filter> <filter-name>ValidatorFilter</filter-name> <filter-class>org.hdiv.filter.ValidatorFilter</filter-class> </filter> <filter-mapping> <filter-name>ValidatorFilter</filter-name> <!-- Spring MVC Servlet name--> <servlet-name>serv1</servlet-name> </filter-mapping> <filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy </filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <servlet> <servlet-name>serv1</servlet-name> <servlet-class> org.springframework.web.servlet.DispatcherServlet </servlet-class> <init-param> <param-name>contextConfigLocation</param-name> <param-value>/WEB-INF/spring-web-config.xml</param-value> </init-param> <load-on-startup>1</load-on-startup> </servlet> <servlet-mapping> <servlet-name>serv1</servlet-name> <url-pattern>/</url-pattern> </servlet-mapping> <session-config> <session-timeout>30</session-timeout> </session-config> 

spring-security.xml

 <!-- To let spring create login page --> <http auto-config="false" disable-url-rewriting="true" use-expressions="true"> <access-denied-handler ref="accessDeniedHandler" /> <!-- CSRF is enabled by default Spring 4 onwards --> <!-- check roles --> <intercept-url pattern="/modules/favicon.ico" access="isAnonymous()" /> <intercept-url pattern="/login.htm" access="isAnonymous()" /> <intercept-url pattern="/login.htm?error" access="isAnonymous()" /> <intercept-url pattern="/logout" access="isAnonymous()" /> <intercept-url pattern="/modules/**" access="hasAnyRole('ROLE_y','ROLE_x')" /> <form-login login-page="/" default-target-url="/modules/dashboard.htm" username-parameter="username" password-parameter="password" authentication-failure-url="/login.htm?error" /> <custom-filter after="SECURITY_CONTEXT_FILTER" ref="hdivFilter" /> <!-- Logout --> <logout logout-url="/logout.htm" delete-cookies="JSESSIONID" invalidate-session="true" logout-success-url="/login.htm" /> <!-- Session Management: Invalid Session Url is for SessionTimeout as well as invalid login --> <session-management session-fixation-protection="newSession" invalid-session-url="/login.htm" session-authentication-error-url="/login.htm"> <!-- Concurrency control is to check number of sessions and act accordingly. Error If Max exceeded stops a user from logging in if max-sessions have been exceeded. Expired Url is different from invalid url. --> <concurrency-control max-sessions="2" expired-url="/login.htm" error-if-maximum-exceeded="true" /> </session-management> </http> <!-- Spring security authentication manager --> <authentication-manager alias="authenticationManager"> <!-- Custom Auth Provider checks for login with DB and LDAP both --> <authentication-provider ref="customAuthenticationProvider"> </authentication-provider> </authentication-manager> <!-- Bean implements AuthenticationProvider and checks if user is valid --> <beans:bean id="customAuthenticationProvider" class="..employeeportal.common.util.CustomAuthenticationProvider"> <beans:property name="passwordEncoder" ref="encoder" /> </beans:bean> <!-- BCrypt Password encoder --> <beans:bean id="encoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" /> <!-- Access Denied Handler --> <beans:bean id="accessDeniedHandler" class="..employeeportal.common.util.AccessDeniedHandler"> </beans:bean> <beans:bean id="hdivFilter" class="org.hdiv.filter.ValidatorFilter" /> 

spring-web-config.xml

 <mvc:annotation-driven validator="hdivEditableValidator"/> 

...

applicationContext.xml

...具有所有服务/ dao层组件扫描行：

 <context:component-scan base-package="..common.service, ..common.dao" /> 

hdiv-config.xml

 <?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:context="http://www.springframework.org/schema/context" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hdiv="http://www.hdiv.org/schema/hdiv" xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.1.xsd http://www.hdiv.org/schema/hdiv http://www.hdiv.org/schema/hdiv/hdiv.xsd"> <hdiv:config excludedExtensions="css,ico,js,woff,woff2,ttf,jpg,jpeg,png,gif,eot" errorPage="/security-error" randomName="true" confidentiality="true" debugMode="true"> <hdiv:startPages method="get">/,/login.htm</hdiv:startPages> <hdiv:startPages method="post">/logout, /logout.htm</hdiv:startPages> <hdiv:startParameters>_csrf</hdiv:startParameters> </hdiv:config> <!-- Accepted pattern within the application for all editable parameters (generated from textbox and textarea) --> <hdiv:validation id="safeText"> <hdiv:acceptedPattern><![CDATA[^[a-zA-Z0-9@.\\-_]*$]]></hdiv:acceptedPattern> </hdiv:validation> <!-- Finally, it's necessary to define editable data validation list for the application --> <hdiv:editableValidations> <hdiv:validationRule url="/modules/.*"></hdiv:validationRule> <hdiv:validationRule url="/modules/.*" enableDefaults="false">safeText</hdiv:validationRule> </hdiv:editableValidations> 

index.jsp

 <form:form name='loginForm' modelAttribute="loginForm" action="login" method='POST'> <div class="form-group"> <div class="input-group"> <span class="input-group-addon"><i class="fa fa-user"></i></span> <form:input path="username" name="username" id="username"/> </div> </div> <div class="form-group"> <div class="input-group"> <form:input path="password" id="password" name="password"/> </div> </div> <div class="form-group no-border margin-top-20"> <input type="submit" class="btn btn-success btn-block" value="Submit" /> </div> </form:form> 

任何帮助，将不胜感激。

Answer 1

看来问题与CSRF无关。

Hdiv会验证所有传入的请求，并且为此，必须使用某些受支持的技术（例如Spring MVC标签）在服务器端呈现所有URL和参数。

您是否正在使用Spring MVC URL标记呈现错误文件中包含的URL？

一旦使用Spring MVC标签，Hdiv将在URL中包含一个附加参数（HDIV_STATE），您将避免该问题。

使用此参数可以防止对定义的URL进行任何篡改攻击。

其他可能的解决方案是使用URL排除来消除对此特定URL或URls类型的验证，而Hdiv不会验证这些URL。

参见以下示例： https : //github.com/hdiv/hdiv-spring-mvc-showcase-jc/blob/master/src/main/java/org/hdiv/samples/mvc/config/HdivSecurityConfig.java在addExclusions内方法被定义为不同的排除项。

问候，

罗伯托·贝拉斯科

Hdiv安全

Answer 2

我找到了解决方案。 HDIV要求所有链接的URL中都带有“ _HDIV_STATE_”参数。 为了实现这一点，您必须使用HDIV的taglib，而不是原始的JSTL taglib。

另请参阅HDIV的参考文档

例如在您的POM中

    <dependency>
        <groupId>org.hdiv</groupId>
        <artifactId>hdiv-jstl-taglibs-1.2</artifactId>
        <version>${org.hdiv-version}</version>
    </dependency>

例如在您的JSP中（请注意taglib语句中的“ www.hdiv.org”）

<%@ taglib prefix="c" uri="http://www.hdiv.org/jsp/jstl/core"%> <c:url value="/messages/messages" var="url" /> <li><a href="${url}">Messages</a></li>

因此，您需要通过<c:url>实用工具标记呈现URL。 然后使用所需的HDIV参数呈现URL，即

localhost:8080/spring-security-example/messages/message?_HDIV_STATE_=26-0-830046F08D66980D1B35F52F2D6677E0

另一个选择是使用HDIV中的实用程序类，另请参见hdiv github存储库中的类LinkUrlProcessor

LinkUrlProcessor urlProcessor = HDIVUtil.getLinkUrlProcessor(servletContext);
String processUrl = urlProcessor.processUrl(request, "/messages/messages");