java - 无法验证提供的 CSRF token 。仅使用 xml

Question

我正在学习 Spring 框架，为了安全起见，我正在使用 xml 配置文件:

<security:http once-per-request="false" use-expressions="true">
    <!-- <security:intercept-url pattern="/admin" access="hasAuthority('ROLE_ADMIN')" /> -->
    <security:intercept-url pattern="/admin" access="permitAll" />
    <security:intercept-url pattern="/createoffer" access="isAuthenticated()" />
    <security:intercept-url pattern="/docreateoffer" access="isAuthenticated()" />
    <security:intercept-url pattern="/offercreated" access="isAuthenticated()" />
    <security:intercept-url pattern="/" access="permitAll" />
    <security:intercept-url pattern="/denied" access="permitAll" />     
    <security:intercept-url pattern="/loggedout" access="permitAll" />
    <security:intercept-url pattern="/newaccount" access="permitAll" />
    <security:intercept-url pattern="/createaccount" access="permitAll" />
    <security:intercept-url pattern="/accountcreated" access="permitAll" />
    <security:intercept-url pattern="/static/**" access="permitAll" />
    <security:intercept-url pattern="/login" access="permitAll" />
    <security:intercept-url pattern="/offers" access="permitAll" />
    <security:intercept-url pattern="/**" access="denyAll" />
    <security:form-login login-page="/login" authentication-failure-url="/login?error=true" />
    <security:logout logout-success-url="/loggedout" logout-url="/logout"/>
    <security:remember-me key="offersAppKey"
        user-service-ref="jdbcUserService"
        remember-me-parameter="remember-me" token-validity-seconds="1209600" />
</security:http>

在我的登录表单中:

<form name='f' action='${pageContext.request.contextPath}/login'
    method='POST'>
    <table>
        <tr>
            <td>User:</td>
            <td><input type='text' name='username' value=''></td>
        </tr>
        <tr>
            <td>Password:</td>
            <td><input type='password' name='password' /></td>
        </tr>
        <tr>
            <td>Remember Me</td>
            <td><input type="checkbox" checked="checked" name="remember-me" /></td>
        </tr>
        <tr>
            <td colspan='2'><input name="submit" type="submit"
                value="Login" /></td>
        </tr>
        <input type="hidden" name="${_csrf.parameterName}"
            value="${_csrf.token}" />
    </table>
</form>

但是在我登录并经过一段时间后(我在 web.xml 中将 session 超时设置为 1 分钟)我在浏览器中收到此错误:

Could not verify the provided CSRF token because your session was not found.

到目前为止，我找不到任何仅使用 xml 文件进行配置的帖子。这都是关于使用 java 进行配置的，其他一些答案建议包括 csrf在登录表单中隐藏输入，我已经这样做了。知道如何解决这个问题吗？

附言:web.xml 文件如下所示:


<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd" id="WebApp_ID" version="3.1">
<display-name>spring-tutorial-51</display-name>
<description>Spring tutorial web app</description>
<welcome-file-list>
<welcome-file>index.html</welcome-file>
<welcome-file>index.htm</welcome-file>
<welcome-file>index.jsp</welcome-file>
<welcome-file>default.html</welcome-file>
<welcome-file>default.htm</welcome-file>
<welcome-file>default.jsp</welcome-file>
</welcome-file-list>
<servlet>
<description></description>
<display-name>offers</display-name>
<servlet-name>offers</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>offers</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
<resource-ref>
<description>DB Connection</description>
<res-ref-name>jdbc/springtutorial</res-ref-name>
<res-type>javax.sql.DataSource</res-type>
<res-auth>Container</res-auth>
</resource-ref>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
classpath:com/myproject/spring/web/config/dao-context.xml
classpath:com/myproject/spring/web/config/service-context.xml
classpath:com/myproject/spring/web/config/security-context.xml
</param-value>
</context-param>
<filter>
<display-name>springSecurityFilterChain</display-name>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<session-config>
<session-timeout>1</session-timeout>
</session-config>
</web-app>


我将以下配置添加到我的安全配置文件中。

我将此添加到我的 security-context.xml这是一个安全配置文件。

<security:remember-me key="offersAppKey"
user-service-ref="jdbcUserService"
remember-me-parameter="remember-me" token-validity-seconds="1209600" />

我希望 token 在 1 分钟后有效，持续 1209600 秒。

Answer 1

我不明白这里令人惊讶的部分在哪里？你说的

I set the session timeout to be 1 minute in the web.xml

除了您的 session 之外，服务器还可以在哪里存储您的 CSRF token 副本？因此，当您的 session 在一分钟内过期时，服务器无法在您的请求中找到与 CSRF token 匹配的副本并引发此类异常。

我想你可以在https://github.com/spring-projects/spring-security/blob/master/web/src/main/java/org/springframework/security/web/csrf/CsrfFilter.java#L113附近看到相关代码和 https://github.com/spring-projects/spring-security/blob/master/web/src/main/java/org/springframework/security/web/csrf/HttpSessionCsrfTokenRepository.java#L75

因此，要解决此问题，只需增加 session 超时时间。 (仅 1 分钟的超时对我来说似乎非常严格。我在现实生活中从未见过任何少于 10 分钟的东西，即使是在“安全”的地方，而且通常更多。)