什么是CSRF攻击，以及如何防御

转x33g5p2x  于2022-04-15 转载在 其他  
字(13.1k)|赞(0)|评价(0)|浏览(261)

1.CSRF攻击的概念

1.CSRF全称为Cross Site Request Forgery，跨域请求伪造。这是一种很常见的Web攻击方式，如下为一个简单的攻击流程。
1）假设用户打开了一个银行网站，并且登录了
2）登录成功后，会返回一个cookie给前端，浏览器将cookie保存下来
3）用户在没有登出银行网站的情况下，在当前浏览器又新打开多了一个选项卡，访问了一个危险的网站
4）这个网站有个危险的超链接，这个超链接指向了银行网站
5）用户点击这个超链接，由于这个超链接会自动携带上cookie,所以用户不知不觉在点击这个超链接的时候，还要一些请求是发到了银行网站那里去。

2.CSRF攻击简单案例

2.1 银行网站项目

1.pom.xml

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  3.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  4.     <modelVersion>4.0.0</modelVersion>
  5.     <parent>
  6.         <groupId>org.springframework.boot</groupId>
  7.         <artifactId>spring-boot-starter-parent</artifactId>
  8.         <version>2.6.6</version>
  9.         <relativePath/> <!-- lookup parent from repository -->
  10.     </parent>
  11.     <groupId>com.yl</groupId>
  12.     <artifactId>csrf-1</artifactId>
  13.     <version>0.0.1-SNAPSHOT</version>
  14.     <name>csrf-1</name>
  15.     <description>Demo project for Spring Boot</description>
  16.     <properties>
  17.         <java.version>11</java.version>
  18.     </properties>
  19.     <dependencies>
  20.         <dependency>
  21.             <groupId>org.springframework.boot</groupId>
  22.             <artifactId>spring-boot-starter-security</artifactId>
  23.         </dependency>
  24.         <dependency>
  25.             <groupId>org.springframework.boot</groupId>
  26.             <artifactId>spring-boot-starter-web</artifactId>
  27.         </dependency>
  29.         <dependency>
  30.             <groupId>org.springframework.boot</groupId>
  31.             <artifactId>spring-boot-starter-test</artifactId>
  32.             <scope>test</scope>
  33.         </dependency>
  34.         <dependency>
  35.             <groupId>org.springframework.security</groupId>
  36.             <artifactId>spring-security-test</artifactId>
  37.             <scope>test</scope>
  38.         </dependency>
  39.     </dependencies>
  41.     <build>
  42.         <plugins>
  43.             <plugin>
  44.                 <groupId>org.springframework.boot</groupId>
  45.                 <artifactId>spring-boot-maven-plugin</artifactId>
  46.             </plugin>
  47.         </plugins>
  48.     </build>
  50. </project>

2.application.properties

  1. spring.security.user.name=admin
  2. spring.security.user.password=123

3.security的配置

  1. package com.yl.csrf1.config;
  3. import org.springframework.context.annotation.Configuration;
  4. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  5. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  7. @Configuration
  8. public class SecurityConfig extends WebSecurityConfigurerAdapter {
  9.     @Override
  10.     protected void configure(HttpSecurity http) throws Exception {
  11.         http.authorizeRequests()
  12.                 .anyRequest()
  13.                 .authenticated()
  14.                 .and()
  15.                 .formLogin()
  16.                 .permitAll()
  17.                 .and()
  18.                 .csrf().disable();
  19.     }
  20. }

4.controller,假设这个接口就是真实涉及到转账的

  1. package com.yl.csrf1.controller;
  3. import org.springframework.web.bind.annotation.PostMapping;
  4. import org.springframework.web.bind.annotation.RestController;
  6. @RestController
  7. public class HelloController {
  9.     @PostMapping("/transfer")
  10.     public void transfer(String username,Double money) {
  11.         System.out.println("username=" + username);
  12.         System.out.println("money=" + money);
  13.     }
  14. }

2.2 危险网站的项目

1.pom.xml

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  3.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  4.     <modelVersion>4.0.0</modelVersion>
  5.     <parent>
  6.         <groupId>org.springframework.boot</groupId>
  7.         <artifactId>spring-boot-starter-parent</artifactId>
  8.         <version>2.6.6</version>
  9.         <relativePath/> <!-- lookup parent from repository -->
  10.     </parent>
  11.     <groupId>com.yl</groupId>
  12.     <artifactId>csrf2</artifactId>
  13.     <version>0.0.1-SNAPSHOT</version>
  14.     <name>csrf2</name>
  15.     <description>Demo project for Spring Boot</description>
  16.     <properties>
  17.         <java.version>11</java.version>
  18.     </properties>
  19.     <dependencies>
  20.         <dependency>
  21.             <groupId>org.springframework.boot</groupId>
  22.             <artifactId>spring-boot-starter-web</artifactId>
  23.         </dependency>
  25.         <dependency>
  26.             <groupId>org.springframework.boot</groupId>
  27.             <artifactId>spring-boot-starter-test</artifactId>
  28.             <scope>test</scope>
  29.         </dependency>
  30.     </dependencies>
  32.     <build>
  33.         <plugins>
  34.             <plugin>
  35.                 <groupId>org.springframework.boot</groupId>
  36.                 <artifactId>spring-boot-maven-plugin</artifactId>
  37.             </plugin>
  38.         </plugins>
  39.     </build>
  41. </project>

2.application.properties

  1. server.port=8081

3.static下的静态资源

  1. <!DOCTYPE html>
  2. <html lang="en">
  3. <head>
  4.     <meta charset="UTF-8">
  5.     <title>Title</title>
  6. </head>
  7. <body>
  8. <form method="post" action="http://localhost:8080/transfer">
  9.     <input type="hidden" name="username" value="张三">
  10.     <input type="hidden" name="money" value="1000">
  11.     <input type="submit" value="点击查看美女图片">
  12. </form>
  13. </body>
  14. </html>

2.3 测试

1.登录银行网站

2.访问危险网站，并且点击超链接

可以看到在危险网站上点击某些超链接，其可以访问到银行网站的转账接口

3.默认的CSRF防御策略

1.pom.xml

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  3.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  4.     <modelVersion>4.0.0</modelVersion>
  5.     <parent>
  6.         <groupId>org.springframework.boot</groupId>
  7.         <artifactId>spring-boot-starter-parent</artifactId>
  8.         <version>2.6.6</version>
  9.         <relativePath/> <!-- lookup parent from repository -->
  10.     </parent>
  11.     <groupId>com.yl</groupId>
  12.     <artifactId>csrf3</artifactId>
  13.     <version>0.0.1-SNAPSHOT</version>
  14.     <name>csrf3</name>
  15.     <description>Demo project for Spring Boot</description>
  16.     <properties>
  17.         <java.version>11</java.version>
  18.     </properties>
  19.     <dependencies>
  20.         <dependency>
  21.             <groupId>org.springframework.boot</groupId>
  22.             <artifactId>spring-boot-starter-security</artifactId>
  23.         </dependency>
  24.         <dependency>
  25.             <groupId>org.springframework.boot</groupId>
  26.             <artifactId>spring-boot-starter-thymeleaf</artifactId>
  27.         </dependency>
  28.         <dependency>
  29.             <groupId>org.springframework.boot</groupId>
  30.             <artifactId>spring-boot-starter-web</artifactId>
  31.         </dependency>
  32.         <dependency>
  33.             <groupId>org.thymeleaf.extras</groupId>
  34.             <artifactId>thymeleaf-extras-springsecurity5</artifactId>
  35.         </dependency>
  37.         <dependency>
  38.             <groupId>org.springframework.boot</groupId>
  39.             <artifactId>spring-boot-starter-test</artifactId>
  40.             <scope>test</scope>
  41.         </dependency>
  42.         <dependency>
  43.             <groupId>org.springframework.security</groupId>
  44.             <artifactId>spring-security-test</artifactId>
  45.             <scope>test</scope>
  46.         </dependency>
  47.     </dependencies>
  49.     <build>
  50.         <plugins>
  51.             <plugin>
  52.                 <groupId>org.springframework.boot</groupId>
  53.                 <artifactId>spring-boot-maven-plugin</artifactId>
  54.             </plugin>
  55.         </plugins>
  56.     </build>
  58. </project>

2.application.properties

  1. spring.security.user.name=root
  2. spring.security.user.password=123

3.controller

  1. package com.yl.csrf3.controller;
  3. import org.springframework.stereotype.Controller;
  4. import org.springframework.web.bind.annotation.GetMapping;
  5. import org.springframework.web.bind.annotation.PostMapping;
  6. import org.springframework.web.bind.annotation.ResponseBody;
  8. @Controller
  9. public class HelloController {
  11.     @PostMapping("/hello")
  12.     @ResponseBody
  13.     public String hello() {
  14.         return "hello";
  15.     }
  17.     @GetMapping("/01")
  18.     public String hello2() {
  19.         return "01";
  20.     }
  21. }

4.template目录下的静态资源

  1. <!DOCTYPE html>
  2. <html lang="en" xmlns:th="http://www.thymeleaf.org">
  3. <head>
  4.     <meta charset="UTF-8">
  5.     <title>Title</title>
  6. </head>
  7. <body>
  8. <form method="post" action="/hello">
  9.     <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
  10.     <input type="submit" value="提交">
  11. </form>
  12. </body>
  13. </html>

5.访问01接口，然后登录

6.然后提交，获取内容

7.然后我们观察hello请求，发现，其实在发请求的时候，不仅仅是把cookie传到后台，还把一个随机参数传到了后台，后台还要校验这个随机参数，这种方式可以解决CSRF攻击

4前后端分离的CSRF防御策略

1.pom.xml

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  3.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  4.     <modelVersion>4.0.0</modelVersion>
  5.     <parent>
  6.         <groupId>org.springframework.boot</groupId>
  7.         <artifactId>spring-boot-starter-parent</artifactId>
  8.         <version>2.6.6</version>
  9.         <relativePath/> <!-- lookup parent from repository -->
  10.     </parent>
  11.     <groupId>com.yl</groupId>
  12.     <artifactId>csrf3</artifactId>
  13.     <version>0.0.1-SNAPSHOT</version>
  14.     <name>csrf3</name>
  15.     <description>Demo project for Spring Boot</description>
  16.     <properties>
  17.         <java.version>11</java.version>
  18.     </properties>
  19.     <dependencies>
  20.         <dependency>
  21.             <groupId>org.springframework.boot</groupId>
  22.             <artifactId>spring-boot-starter-security</artifactId>
  23.         </dependency>
  24.         <dependency>
  25.             <groupId>org.springframework.boot</groupId>
  26.             <artifactId>spring-boot-starter-thymeleaf</artifactId>
  27.         </dependency>
  28.         <dependency>
  29.             <groupId>org.springframework.boot</groupId>
  30.             <artifactId>spring-boot-starter-web</artifactId>
  31.         </dependency>
  32.         <dependency>
  33.             <groupId>org.thymeleaf.extras</groupId>
  34.             <artifactId>thymeleaf-extras-springsecurity5</artifactId>
  35.         </dependency>
  37.         <dependency>
  38.             <groupId>org.springframework.boot</groupId>
  39.             <artifactId>spring-boot-starter-test</artifactId>
  40.             <scope>test</scope>
  41.         </dependency>
  42.         <dependency>
  43.             <groupId>org.springframework.security</groupId>
  44.             <artifactId>spring-security-test</artifactId>
  45.             <scope>test</scope>
  46.         </dependency>
  47.     </dependencies>
  49.     <build>
  50.         <plugins>
  51.             <plugin>
  52.                 <groupId>org.springframework.boot</groupId>
  53.                 <artifactId>spring-boot-maven-plugin</artifactId>
  54.             </plugin>
  55.         </plugins>
  56.     </build>
  58. </project>

2.application.properties

  1. spring.security.user.name=root
  2. spring.security.user.password=123

3.security的配置

  1. package com.yl.csrf3.config;
  3. import org.springframework.context.annotation.Configuration;
  4. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  5. import org.springframework.security.config.annotation.web.builders.WebSecurity;
  6. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  7. import org.springframework.security.core.Authentication;
  8. import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
  9. import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
  11. import javax.servlet.ServletException;
  12. import javax.servlet.http.HttpServletRequest;
  13. import javax.servlet.http.HttpServletResponse;
  14. import java.io.IOException;
  16. @Configuration
  17. public class SecurityConfig extends WebSecurityConfigurerAdapter {
  19.     @Override
  20.     public void configure(WebSecurity web) throws Exception {
  21.         web.ignoring().antMatchers("/js/**");
  22.     }
  24.     @Override
  25.     protected void configure(HttpSecurity http) throws Exception {
  26.         http.authorizeRequests()
  27.                 .anyRequest()
  28.                 .authenticated()
  29.                 .and()
  30.                 .formLogin()
  31.                 .loginPage("/01.html")
  32.                 .loginProcessingUrl("/login")
  33.                 .successHandler(new AuthenticationSuccessHandler() {
  34.                     @Override
  35.                     public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
  36.                         response.getWriter().write("login success");
  37.                     }
  38.                 })
  39.                 .permitAll()
  40.                 .and()
  41.                 .csrf()
  42.                 .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
  43.     }
  44. }

4.static下的静态资源，01.html

  1. <!DOCTYPE html>
  2. <html lang="en">
  3. <head>
  4.     <meta charset="UTF-8">
  5.     <title>Title</title>
  6.     <script src="js/jquery-1.8.3.min.js"></script>
  7.     <script src="js/jquery.cookie.js"></script>
  9. </head>
  10. <body>
  11. <div>
  12.     <input type="text" id="username"/>
  13.     <input type="text" id="password"/>
  14.     <input type="submit" value="登录" id="loginBtn">
  15. </div>
  16. <script>
  17.     $('#loginBtn').click(function () {
  18.         $.post('/login',{username:$('#username').val(),password:$('#password').val(),_csrf:$.cookie('XSRF-TOKEN')},function (data) {
  19.             alert(data)
  20.         })
  21.     })
  22. </script>
  23. </body>
  24. </html>

5.还要在satic目录下加入jquery.js和jquery-cookie.js

6.访问登录页面，登录root账号

7.再去看登录接口，发现其实它也传了一个随机参数

版权说明 : 本文为转载文章, 版权归原作者所有 版权申明

原文链接 : https://blog.csdn.net/weixin_41359273/article/details/124180574

内容来源于网络，如有侵权，请联系作者删除！

spring

相关文章

    查看更多

    热门标签

    更多
    JavaquerypythonNode开发语言requestUtil数据库Table后端算法LoggerMessageElementParser

    最新文章

    更多
    • 蜀ICP备13028337号-1 大数据知识库 https://www.saoniuhuo.com © All rights reserved
    • 本站内容来源互联网,如果侵犯您的权益请联系我们删除, 联系方式：448109455@qq.com