Spring 使用 CSRF 令牌的安全性，即使未指定並關閉

Question

對於我的項目，我正在嘗試制作一個可以執行 POST、GET 和 DELETE 請求的簡單服務。 我對 CSRF 添加的額外安全層不感興趣，所以我希望它關閉。 我知道默認情況下它應該關閉，但它似乎沒有表現。 每次我發出一個帖子請求時，它都會給我以下 output：

/users/insert at position 1 of 15 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
o.s.security.web.FilterChainProxy        : /users/insert at position 2 of 15 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
w.c.HttpSessionSecurityContextRepository : No HttpSession currently exists
w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: null. A new one will be created.
o.s.security.web.FilterChainProxy        : /users/insert at position 3 of 15 in additional filter chain; firing Filter: 'HeaderWriterFilter'
o.s.security.web.FilterChainProxy        : /users/insert at position 4 of 15 in additional filter chain; firing Filter: 'CsrfFilter'
o.s.security.web.csrf.CsrfFilter         : Invalid CSRF token found for http://localhost:8080/users/insert
o.s.s.w.header.writers.HstsHeaderWriter  : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@6c3a524b
w.c.HttpSessionSecurityContextRepository : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed

如果我做一個 GET 請求，它工作得很好。

我的 pom.xml：

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.1.3.RELEASE</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>com.webservices</groupId>
    <artifactId>restservice</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>restservice</name>
    <description>Rest webservice</description>

    <properties>
        <java.version>1.8</java.version>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-hateoas</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-test</artifactId>
            <version>5.3.2.RELEASE</version>
            <scope>test</scope>
        </dependency>

         <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <scope>runtime</scope>
        </dependency>

        <dependency>
            <groupId>org.springframework.data</groupId>
            <artifactId>spring-data-rest-hal-browser</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.data</groupId>
            <artifactId>spring-data-rest-hal-browser</artifactId>
        </dependency>

        <dependency>
            <groupId>io.springfox</groupId>
            <artifactId>springfox-swagger2</artifactId>
            <version>2.9.2</version>
        </dependency>

        <dependency>
            <groupId>io.springfox</groupId>
            <artifactId>springfox-swagger-ui</artifactId>
            <version>2.9.2</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-devtools</artifactId>
            <scope>runtime</scope>
            <optional>true</optional>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
            <exclusions>
                <exclusion>
                    <groupId>org.junit.vintage</groupId>
                    <artifactId>junit-vintage-engine</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

</project>

在我的 application.properties 中，我嘗試了security.enable.csrf=false ，但它不起作用。

Answer 1

CSRF代表跨站點請求偽造，在使用 Spring 安全性時默認啟用，如下所示，

public CsrfConfigurer<HttpSecurity> csrf() throws Exception {
    ApplicationContext context = getContext();
    return getOrApply(new CsrfConfigurer<>(context));
}  

完全禁用

@Override
public void configure(HttpSecurity http) throws Exception {

    http
        .csrf().disable()...
}

部分啟用

@Override
public void configure(HttpSecurity http) throws Exception {

    http
        .csrf().ignoringAntMatchers("csrf-disabled-endpoints")...
}

包括 CSRF

@Override
public void configure(HttpSecurity http) throws Exception {

    http
        .csrf().ignoringAntMatchers("csrf-disabled-endpoints")
        .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())...
}

您可能想在這里探索更多細節Cookie CsrfTokenRepository.withHttpOnlyFalse () 有什么作用以及何時使用它？

Answer 2

默認情況下啟用 CSRF 保護。 默認情況下，無法通過在 application.properties 中配置來禁用 csrf 功能。 正如 Patel 指出的那樣，這必須通過在 HttpSecurity 配置上禁用 csrf 來完成。

See https://docs.spring.io/spring-security/site/docs/current/reference/html5/#servlet-csrf-configure-disable on how to do this using either XML or Java configuration.

您可以在 java 配置中使用 @Value 創建自己的 application.properties 條目。 例如@Value("${security.enable.csrf}") private boolean csrfEnabled;

Answer 3

Patel Romil 的回答解決了我的問題！

Have you added the csrf.disable() in configure(HttpSecurity http) method?