我必须向我的 restful 服务发出 HTTP.Post(Android 应用程序)，以注册新用户!

问题是，当我尝试向注册端点(没有安全性)发出请求时，Spring 一直阻止我!

我的项目依赖

<properties>
    <java-version>1.6</java-version>
    <org.springframework-version>4.1.7.RELEASE</org.springframework-version>
    <org.aspectj-version>1.6.10</org.aspectj-version>
    <org.slf4j-version>1.6.6</org.slf4j-version>
    <jackson.version>1.9.10</jackson.version>
    <spring.security.version>4.0.2.RELEASE</spring.security.version>
    <hibernate.version>4.2.11.Final</hibernate.version>
    <jstl.version>1.2</jstl.version>
    <mysql.connector.version>5.1.30</mysql.connector.version>
</properties>

Spring 安全

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security.xsd">

<!--this is the register endpoint-->
<http security="none" pattern="/webapi/cadastro**"/>


    <http auto-config="true" use-expressions="true">
                <intercept-url pattern="/webapi/dados**"
            access="hasAnyRole('ROLE_USER','ROLE_SYS')" />
        <intercept-url pattern="/webapi/system**"
            access="hasRole('ROLE_SYS')" />

<!--        <access-denied-handler error-page="/negado" /> -->
        <form-login login-page="/home/" default-target-url="/webapi/"
            authentication-failure-url="/home?error" username-parameter="username"
            password-parameter="password" />
        <logout logout-success-url="/home?logout" />        
        <csrf token-repository-ref="csrfTokenRepository" />
    </http>

    <authentication-manager>
        <authentication-provider>
            <password-encoder hash="md5" />
            <jdbc-user-service data-source-ref="dataSource"
                users-by-username-query="SELECT username, password, ativo
                   FROM usuarios 
                  WHERE username = ?"
                authorities-by-username-query="SELECT u.username, r.role
                   FROM usuarios_roles r, usuarios u
                  WHERE u.id = r.usuario_id
                    AND u.username = ?" />
        </authentication-provider>
    </authentication-manager>

    <beans:bean id="csrfTokenRepository"
        class="org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository">
        <beans:property name="headerName" value="X-XSRF-TOKEN" />
    </beans:bean>

</beans:beans>

Controller

@RestController
@RequestMapping(value="/webapi/cadastro", produces="application/json")
public class CadastroController {
    @Autowired 
    UsuarioService usuarioService;

    Usuario u = new Usuario();

    @RequestMapping(value="/novo",method=RequestMethod.POST)
    public String register() {
        // this.usuarioService.insert(usuario);
        // usuario.setPassword(HashMD5.criptar(usuario.getPassword()));
        return "teste";
     }
}

JS 发布( Angular )

$http.post('/webapi/cadastro/novo').success(function(data) {
            alert('ok');
         }).error(function(data) {
             alert(data);
         });

错误

HTTP Status 403 - Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-XSRF-TOKEN'.</h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u>Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-XSRF-TOKEN'

--- 解决方案 ---

实现过滤器以将我的 X-XSRF-TOKEN 附加到每个请求 header

public class CsrfHeaderFilter extends OncePerRequestFilter {
  @Override
  protected void doFilterInternal(HttpServletRequest request,
      HttpServletResponse response, FilterChain filterChain)
      throws ServletException, IOException {
    CsrfToken csrf = (CsrfToken) request.getAttribute(CsrfToken.class
        .getName());
    if (csrf != null) {
      Cookie cookie = WebUtils.getCookie(request, "XSRF-TOKEN");
      String token = csrf.getToken();
      if (cookie==null || token!=null && !token.equals(cookie.getValue())) {
        cookie = new Cookie("XSRF-TOKEN", token);
        cookie.setPath("/");
        response.addCookie(cookie);
      }
    }
    filterChain.doFilter(request, response);
  }
}

将此过滤器的映射添加到 web.xml 并完成!

最佳答案

在你上面的代码中，我看不到将 CSRF token 传递给客户端的东西(如果你使用 JSP 等，这是自动的)。

一个流行的做法是编写一个过滤器以将 CSRF token 附加为 cookie。然后您的客户端首先发送一个 GET 请求来获取该 cookie。对于后续请求，该 cookie 将作为 header 发回。

而官方Spring Angular guide详细解释，可以引用Spring Lemon一个完整的工作示例。

要将 cookie 作为 header 发回，您可能需要编写一些代码。默认情况下，AngularJS 会这样做(除非您发送跨域请求)，但这里有一个示例，如果您的客户不这样做的话，它会有所帮助:

angular.module('appBoot')
  .factory('XSRFInterceptor', function ($cookies, $log) {

    var XSRFInterceptor = {

      request: function(config) {

        var token = $cookies.get('XSRF-TOKEN');

        if (token) {
          config.headers['X-XSRF-TOKEN'] = token;
          $log.info("X-XSRF-TOKEN: " + token);
        }

        return config;
      }
    };
    return XSRFInterceptor;
  });

angular.module('appBoot', ['ngCookies', 'ngMessages', 'ui.bootstrap', 'vcRecaptcha'])
    .config(['$httpProvider', function ($httpProvider) {

      $httpProvider.defaults.withCredentials = true;
      $httpProvider.interceptors.push('XSRFInterceptor');

    }]);

关于java - HTTP 状态 403 - 在请求参数中发现无效的 CSRF token 'null'，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/31978464/