SpringSecurity的防Csrf攻击实现代码解析

public final class CsrfFilter extends OncePerRequestFilter {
 public static final RequestMatcher DEFAULT_CSRF_MATCHER = new
   CsrfFilter.DefaultRequiresCsrfMatcher();
 private final Log logger = LogFactory.getLog(this.getClass());
 private final CsrfTokenRepository tokenRepository;
 private RequestMatcher requireCsrfProtectionMatcher;
 private AccessDeniedHandler accessDeniedHandler;
 public CsrfFilter(CsrfTokenRepository csrfTokenRepository) {
  this.requireCsrfProtectionMatcher = DEFAULT_CSRF_MATCHER;
  this.accessDeniedHandler = new AccessDeniedHandlerImpl();
  Assert.notNull(csrfTokenRepository, "csrfTokenRepository cannot be null");
  this.tokenRepository = csrfTokenRepository;
 }
 //通过这里可以看出SpringSecurity的csrf机制把请求方式分成两类来处理
 protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
         FilterChain filterChain) throws ServletException, IOException {
  request.setAttribute(HttpServletResponse.class.getName(), response);
  CsrfToken csrfToken = this.tokenRepository.loadToken(request);
  boolean missingToken = csrfToken == null;
  if (missingToken) {
   csrfToken = this.tokenRepository.generateToken(request);
   this.tokenRepository.saveToken(csrfToken, request, response);
  }
  request.setAttribute(CsrfToken.class.getName(), csrfToken);
  request.setAttribute(csrfToken.getParameterName(), csrfToken);
//第一类："GET", "HEAD", "TRACE", "OPTIONS"四类请求可以直接通过
  if (!this.requireCsrfProtectionMatcher.matches(request)) {
   filterChain.doFilter(request, response);
  } else {
//第二类：除去上面四类，包括POST都要被验证携带token才能通过
   String actualToken = request.getHeader(csrfToken.getHeaderName());
   if (actualToken == null) {
    actualToken = request.getParameter(csrfToken.getParameterName());
   }
   if (!csrfToken.getToken().equals(actualToken)) {
    if (this.logger.isDebugEnabled()) {
     this.logger.debug("Invalid CSRF token found for " +
       UrlUtils.buildFullRequestUrl(request));
    }
    if (missingToken) {
     this.accessDeniedHandler.handle(request, response, new
       MissingCsrfTokenException(actualToken));
    } else {
     this.accessDeniedHandler.handle(request, response, new
       InvalidCsrfTokenException(csrfToken, actualToken));
    }
   } else {
    filterChain.doFilter(request, response);
   }
  }
 }
 public void setRequireCsrfProtectionMatcher(RequestMatcher requireCsrfProtectionMatcher) {
  Assert.notNull(requireCsrfProtectionMatcher, "requireCsrfProtectionMatcher cannot be
  null");
  this.requireCsrfProtectionMatcher = requireCsrfProtectionMatcher;
 }
 public void setAccessDeniedHandler(AccessDeniedHandler accessDeniedHandler) {
  Assert.notNull(accessDeniedHandler, "accessDeniedHandler cannot be null");
  this.accessDeniedHandler = accessDeniedHandler;
 }
 private static final class DefaultRequiresCsrfMatcher implements RequestMatcher {
  private final HashSet<String> allowedMethods;
  private DefaultRequiresCsrfMatcher() {
   this.allowedMethods = new HashSet(Arrays.asList("GET", "HEAD", "TRACE", "OPTIONS"));
 }
  public boolean matches(HttpServletRequest request) {
   return !this.allowedMethods.contains(request.getMethod());
  }
 }
}

@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {

@Override
protected void configure(HttpSecurity http) throws Exception {
 http
//关闭打开的csrf保护
 .csrf().disable();
}
}

public interface CsrfToken extends Serializable {
 String getHeaderName();
 String getParameterName();
 String getToken();
}
//CsrfTokenRepository则定义了如何生成、保存以及加载CsrfToken。
public interface CsrfTokenRepository {
 CsrfToken generateToken(HttpServletRequest request);
 void saveToken(CsrfToken token, HttpServletRequest request,
     HttpServletResponse response);
 CsrfToken loadToken(HttpServletRequest request);
}

<input type='hidden' name='${_csrf.parameterName}' value='${_csrf.token}'>

@Override
 protected void doFilterInternal(HttpServletRequest request,
   HttpServletResponse response, FilterChain filterChain)
     throws ServletException, IOException {
  request.setAttribute(HttpServletResponse.class.getName(), response);
    
    //获取到cookie中的csrf Token（CookieTokenRepository）或者从session中获取（HttpSessionCsrfTokenRepository）
  CsrfToken csrfToken = this.tokenRepository.loadToken(request);
  final boolean missingToken = csrfToken == null;
    //加载不到，则证明请求是首次发起的，应该生成并保存一个新的 CsrfToken 值
  if (missingToken) {
   csrfToken = this.tokenRepository.generateToken(request);
   this.tokenRepository.saveToken(csrfToken, request, response);
  }
  request.setAttribute(CsrfToken.class.getName(), csrfToken);
  request.setAttribute(csrfToken.getParameterName(), csrfToken);

    //排除部分不需要验证CSRF攻击的请求方法（默认忽略了GET、HEAD、TRACE和OPTIONS）
  if (!this.requireCsrfProtectionMatcher.matches(request)) {
   filterChain.doFilter(request, response);
   return;
  }

    //实际的token从header或者parameter中获取
  String actualToken = request.getHeader(csrfToken.getHeaderName());
  if (actualToken == null) {
   actualToken = request.getParameter(csrfToken.getParameterName());
  }
  if (!csrfToken.getToken().equals(actualToken)) {
   if (this.logger.isDebugEnabled()) {
    this.logger.debug("Invalid CSRF token found for "
      + UrlUtils.buildFullRequestUrl(request));
   }
   if (missingToken) {
    this.accessDeniedHandler.handle(request, response,
      new MissingCsrfTokenException(actualToken));
   }
   else {
    this.accessDeniedHandler.handle(request, response,
      new InvalidCsrfTokenException(csrfToken, actualToken));
   }
   return;
  }

  filterChain.doFilter(request, response);
 }

//代码如下：
.and().csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())

<form action="/executeLogin" method="post">
<p>Sign in to continue</p>
<div class="lowin-group">
 <label>用户名 <a href="#" rel="external nofollow" rel="external nofollow" class="login-back-link">Sign in?</a></label>
 <input type="text" name="username" class="lowin-input">
</div>
<div class="lowin-group password-group">
 <label>密码 <a href="#" rel="external nofollow" rel="external nofollow" class="forgot-link">Forgot Password?</a></label>
 <input type="password" name="password" class="lowin-input">
</div>
<div class="lowin-group">
 <label>验证码</label>
 <input type="text" name="kaptcha" class="lowin-input">
 <img src="/kaptcha.jpg" alt="kaptcha" height="50px" width="150px" style="margin-left: 20px">
</div>
<div class="lowin-group">
 <label>记住我</label>
 <input name="remember-me" type="checkbox" value="true" />
</div>
<input type="hidden" name="_csrf">
<input class="lowin-btn login-btn" type="submit">
</form>
 <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js"></script> 
<script>
 $(function () {
  var aCookie = document.cookie.split("; ");
  console.log(aCookie);
  for (var i=0; i < aCookie.length; i++)
  {
   var aCrumb = aCookie[i].split("=");
   if ("XSRF-TOKEN" == aCrumb[0])
    $("input[name='_csrf']").val(aCrumb[1]);
  }
 });
</script>

private static final class DefaultRequiresCsrfMatcher implements RequestMatcher {
  private final HashSet<String> allowedMethods = new HashSet<>(
    Arrays.asList("GET", "HEAD", "TRACE", "OPTIONS"));
  @Override
  public boolean matches(HttpServletRequest request) {
   return !this.allowedMethods.contains(request.getMethod());
  }
 }