Detailed explanation of using spring-security to solve CSRF problems

Introduction to CSRF

CSRF (Cross-site request forgery), Chinese name: Cross-site request forgery, also known as: one click attack/session riding, abbreviated as: CSRF/XSRF.

For the specific introduction and attack methods of SCRF, please refer to the introduction of Baidu Encyclopedia and the analysis of a big cow:
CSRF Baidu Encyclopedia talks
about CSRF attack methods Zhejiang Surrogacy

Configuration steps

1. Depend on jar package

2. <properties>
3. <spring.security.version>4.2.2.RELEASE</spring.security.version>
4. </properties>
5. <dependency>
6. <groupId>org.springframework.security</groupId>
7. <artifactId>spring-security-core</artifactId>
8. <version>${spring.security.version}</version>
9. </dependency>
11. <dependency>
12. <groupId>org.springframework.security</groupId>
13. <artifactId>spring-security-web</artifactId>
14. <version>${spring.security.version}</version>
15. </dependency>
17. <dependency>
18. <groupId>org.springframework.security</groupId>
19. <artifactId>spring-security-config</artifactId>
20. <version>${spring.security.version}</version>
21. </dependency>

copy code

2.web.xml configuration

2. <filter>
3. <filter-name>springSecurityFilterChain</filter-name>
4. <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
5. </filter>
7. <filter-mapping>
8. <filter-name>springSecurityFilterChain</filter-name>
9. <url-pattern>/*</url-pattern>
10. </filter-mapping>

copy code

3. Spring configuration file configuration   Zhejiang surrogacy company

2. <bean id="csrfSecurityRequestMatcher" class="com.xxx.CsrfSecurityRequestMatcher"></bean>
4. <security:http auto-config="true" use-expressions="true">
5. <security:headers>
6. <security:frame-options disabled="true"/>
7. </security:headers>
8. <security:csrf request-matcher-ref="csrfSecurityRequestMatcher" />
9. </security:http>

copy code

4. Custom RequestMatcher implementation class CsrfSecurityRequestMatcher

This class is used to customize which requests do not need to be intercepted and filtered. If csrf is configured, all http requests are intercepted by CsrfFilter, and there is a private class DefaultRequiresCsrfMatcher in CsrfFilter.

Source code 1: DefaultRequiresCsrfMatcher class

2. private static final class DefaultRequiresCsrfMatcher implements RequestMatcher {
3. private final HashSet<String> allowedMethods;
5. private DefaultRequiresCsrfMatcher() {
6. this.allowedMethods = new HashSet(Arrays.asList(new String[]{"GET", "HEAD", "TRACE", "OPTIONS"}));
7. }
9. public boolean matches(HttpServletRequest request) {
10. return !this.allowedMethods.contains(request.getMethod());
11. }
12. }

copy code

From this source code, it can be found that the POST method is excluded, that is to say, only 4 types of methods such as GET|HEAD|TRACE|OPTIONS will be released, and the http requests of other methods must verify whether the token of _csrf is correct, and Usually, when the rest interface service is called in the post method, there is no token of _csrf, so our rest interface call will fail. We need to customize a class to release the type of interface. Take a look at our custom filter:

Source code 2: csrfSecurityRequestMatcher class

2. public class CsrfSecurityRequestMatcher implements RequestMatcher {
3. private Pattern allowedMethods = Pattern.compile("^(GET|HEAD|TRACE|OPTIONS)$");
4. private RegexRequestMatcher unprotectedMatcher = new RegexRequestMatcher("^/rest/.*", null);
6. @Override
7. public boolean matches(HttpServletRequest request) {
8. if(allowedMethods.matcher(request.getMethod()).matches()){
9. return false;
10. }
12. return !unprotectedMatcher.matches(request);
13. }
14. }

copy code

Note: Generally, the rest interface services we define are brought with /rest/ , so if your project does not use this, or there is no rest service in the project, this class can be completely omitted.

5. post request configuration

Generally, there is a common jsp file in our project, which is referenced by every page, so we can do the following configuration in the common file:

2. <meta name="_csrf" content="${_csrf.token}"/>
3. <meta name="_csrf_header" content="${_csrf.headerName}"/>
5. <script>
7. var token = $("meta[name='_csrf']").attr("content");
8. var header = $("meta[name='_csrf_header']").attr("content");
9. $.ajaxSetup({
10. beforeSend: function (xhr) {
11. if(header && token ){
12. xhr.setRequestHeader(header, token);
13. }
14. }}
15. );
16. </script>

copy code

The meaning of $.ajaxSetup is to add this header and token to all our requests, or put it in the form. Note that _csrf should match the configuration in the spring security configuration file, the default is _csrf.

Source code analysis

We know that since csrf is configured, all http requests will be intercepted by CsrfFilter, so look at the source code of CsrfFilter to see the principle at a glance. Here we only look at the specific filtering method:

Source code 3: doFilterInternal method of CsrfFilter

2. protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
3. request.setAttribute(HttpServletResponse.class.getName(), response);
4. CsrfToken csrfToken = this.tokenRepository.loadToken(request);
5. boolean missingToken = csrfToken == null;
6. if(missingToken) {//If the token is empty, it means the first visit and a token object is generated
7. csrfToken = this.tokenRepository.generateToken(request);
8. this.tokenRepository.saveToken(csrfToken, request, response);
9. }
11. request.setAttribute(CsrfToken.class.getName(), csrfToken);
12. //Put the token object into the request, note that the key here is csrfToken.getParameterName()= _csrf, so it is so hard to write on our page.
13. request.setAttribute(csrfToken.getParameterName(), csrfToken);
15. //This macher is the filter we customized in the Spring configuration file, that is, GET, HEAD, TRACE, OPTIONS and our rest are not processed
16. if(!this.requireCsrfProtectionMatcher.matches(request)) {
17. filterChain.doFilter(request, response);
18. } else {
19. String actualToken = request.getHeader(csrfToken.getHeaderName());
20. if(actualToken == null) {
21. actualToken = request.getParameter(csrfToken.getParameterName());
22. }
24. if(!csrfToken.getToken().equals(actualToken)) {
25. if(this.logger.isDebugEnabled()) {
26. this.logger.debug("Invalid CSRF token found for " + UrlUtils.buildFullRequestUrl(request));
27. }
29. if(missingToken) {
30. this.accessDeniedHandler.handle(request, response, new MissingCsrfTokenException(actualToken));
31. } else {
32. this.accessDeniedHandler.handle(request, response, new InvalidCsrfTokenException(csrfToken, actualToken));
33. }
35. } else {
36. filterChain.doFilter(request, response);
37. }
38. }
39. }

copy code

As you can see from the source code, token verification is required for post requests other than our custom filters.

Originally, I wanted to take a screenshot to get a case, and then use the breakpoint to see the value transfer situation on the page and the background.... However, I can't upload pictures here to get crazy. Well, that's all to sum up! If you write something wrong or have other questions, please leave a message to exchange.