java - 状态 403 来自 Postman 的 Post 请求中的 CSRF token 无效

Question

我正在尝试从 Postman 到达端点，但我得到了

 {
    "status":403,"message":"Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-XSRF-TOKEN'.",
    "errorCode":2,"timestamp":1577971981970
  }

有一个类扩展WebSecurityConfigurerAdapter 我尝试配置并允许此端点

.and()
.authorizeRequests()
.antMatchers("api/reset-password/**")
.anyRequest().authenticated()

我仍然得到相同的结果。我什至尝试使用 security.enable-csrf=false 完全禁用 application.properties 中的 CSRF，但结果是相同的我还尝试访问在添加新端点之前配置的其他端点，其行为方式相同。

Answer 1

来自 Spring.io https://docs.spring.io/spring-security/site/docs/3.2.0.CI-SNAPSHOT/reference/html/csrf.html

When should you use CSRF protection? Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-browser clients, you will likely want to disable CSRF protection.

禁用它

@Configuration
public class RestSecurityConfig extends WebSecurityConfigurerAdapter {
  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable();
  }
}

如果您想将其添加到表单操作中，请执行此操作

<form action="./upload?${_csrf.parameterName}=${_csrf.token}" method="post" enctype="multipart/form-data">