javascript - 使用 Spring Security 保护 Web 应用程序免受 CSRF 攻击

Question

我正在我的 Web 应用程序中实现 CSRF 保护。

我用过org.springframework.security.web.csrf.CookieCsrfTokenRepository类来生成 X-XSRF token 。该 token 在每个请求的响应中作为 cookie 发送。

UI 组件是部署在不同服务器上的单页面应用程序，它会读取此 cookie，并从 cookie 中读取 X-XSRF token ，并将其设置为所有后续请求中的 header 。

Spring 验证收到的 X-XSRF token 并允许/拒绝请求。这很好用。

但他们的限制是这个 X-XSRF cookie 必须是 httpOnly是 false以便客户端 JavaScript 可以读取它。

我们无法读取 httpOnly 的 cookie是 true .

是否有其他替代方案可以在 X-XSRF token cookie httpOnly 的 Web 应用程序中保护 Web 应用程序 CSRF是 true .

使用 JavaScript 方法 ( document.cookie ) 我无法读取 httpOnly 的 cookie属性设置为 true ，参见:

• How to read a secure cookie using JavaScript
• Secure and HttpOnly cookies
• Cross-Site Request Forgery Prevention Cheat Sheet

我无法将所有 cookie 更改为 httpOnly是 false在 Websphere 中。

或者我是否遗漏了客户端 JavaScript 可以读取 cookie 的内容，即 httpOnly是 true .

Answer 1

参见Spring Security Reference :

CookieCsrfTokenRepository

There can be cases where users will want to persist the CsrfToken in a cookie. By default the CookieCsrfTokenRepository will write to a cookie named XSRF-TOKEN and read it from a header named X-XSRF-TOKEN or the HTTP parameter _csrf. These defaults come from AngularJS

You can configure CookieCsrfTokenRepository in XML using the following:

<http>
    <!-- ... -->
    <csrf token-repository-ref="tokenRepository"/>
</http>
<b:bean id="tokenRepository"
    class="org.springframework.security.web.csrf.CookieCsrfTokenRepository"
    p:cookieHttpOnly="false"/>

The sample explicitly sets cookieHttpOnly=false. This is necessary to allow JavaScript (i.e. AngularJS) to read it. If you do not need the ability to read the cookie with JavaScript directly, it is recommended to omit cookieHttpOnly=false to improve security.

You can configure CookieCsrfTokenRepository in Java Configuration using:

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf()
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
    }
}

The sample explicitly sets cookieHttpOnly=false. This is necessary to allow JavaScript (i.e. AngularJS) to read it. If you do not need the ability to read the cookie with JavaScript directly, it is recommended to omit cookieHttpOnly=false (by using new CookieCsrfTokenRepository() instead) to improve security.