Spring Boot 在Sping Boot 中禁用特定URL模式的CSRF保护

b5lpy0ml  于 2024-01-06  发布在  Spring
关注(0)|答案(4)|浏览(209)

我使用Sping Boot 和Spring Security来创建我的Web项目。我想为特定的URL模式禁用CSRF保护，以便为Android设备提供API。
使用

我写了如下配置：

  1. package com.hnu.tutorial.configs;
  3. import org.springframework.boot.autoconfigure.security.SecurityProperties;
  4. import org.springframework.context.annotation.Configuration;
  5. import org.springframework.core.annotation.Order;
  6. import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
  7. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  8. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  9. import org.springframework.security.web.util.matcher.RegexRequestMatcher;
  10. import org.springframework.security.web.util.matcher.RequestMatcher;
  12. import javax.servlet.http.HttpServletRequest;
  13. import java.util.regex.Pattern;
  15. @Configuration
  16. @EnableGlobalMethodSecurity(prePostEnabled = true)
  17. @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
  18. public class SecurityConfig extends WebSecurityConfigurerAdapter {
  20.     @Override
  21.     protected void configure(HttpSecurity http) throws Exception {
  22.         CsrfSecurityRequestMatcher crm = new CsrfSecurityRequestMatcher();
  23.         http.csrf().requireCsrfProtectionMatcher(crm).and()
  24.                 .authorizeRequests().antMatchers("/**").permitAll().anyRequest().fullyAuthenticated();
  25. //        http.csrf().disable();
  26.     }
  28.     public class CsrfSecurityRequestMatcher implements RequestMatcher {
  29.         private Pattern allowedMethods = Pattern.compile("^(GET|HEAD|TRACE|OPTIONS)$");
  30.         private RegexRequestMatcher unprotectedMatcher = new RegexRequestMatcher("/api/**", null);
  32.         @Override
  33.         public boolean matches(HttpServletRequest request) {
  34.             if(allowedMethods.matcher(request.getMethod()).matches()){
  35.                 return false;
  36.             }
  37.             return !unprotectedMatcher.matches(request);
  38.         }
  39.     }
  41. }

字符串
当我运行这个项目时，我得到以下错误：

  1. 2016-08-08 09:29:27.172 ERROR 6715 --- [ost-startStop-1] o.a.c.c.C.[Tomcat].[localhost].[/]       : Exception starting filter springSecurityFilterChain
  3. org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'springSecurityFilterChain' defined in class path resource [org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is java.util.regex.PatternSyntaxException: Dangling meta character '*' near index 6
  4. /api/**
  5.       ^
  6.     at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:599) ~[spring-beans-4.2.6.RELEASE.jar:4.2.6.RELEASE]
  7.     at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1123) ~[spring-beans-4.2.6.RELEASE.jar:4.2.6.RELEASE]
  8.     at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1018) ~[spring-beans-4.2.6.RELEASE.jar:4.2.6.RELEASE]
  9.     at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:510) ~[spring-beans-4.2.6.RELEASE.jar:4.2.6.RELEASE]
  10.     at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:482) ~[spring-beans-4.2.6.RELEASE.jar:4.2.6.RELEASE]
  11.     at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:306) ~[spring-beans-4.2.6.RELEASE.jar:4.2.6.RELEASE]
  12.     at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230) ~[spring-beans-4.2.6.RELEASE.jar:4.2.6.RELEASE]
  13.     at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:302) ~[spring-beans-4.2.6.RELEASE.jar:4.2.6.RELEASE]
  14.     at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202) ~[spring-beans-4.2.6.RELEASE.jar:4.2.6.RELEASE]
  15.     at org.springframework.context.support.AbstractApplicationContext.getBean(AbstractApplicationContext.java:1060) ~[spring-context-4.2.6.RELEASE.jar:4.2.6.RELEASE]
  16.     at org.springframework.web.filter.DelegatingFilterProxy.initDelegate(DelegatingFilterProxy.java:326) ~[spring-web-4.2.6.RELEASE.jar:4.2.6.RELEASE]
  17.     at org.springframework.web.filter.DelegatingFilterProxy.initFilterBean(DelegatingFilterProxy.java:235) ~[spring-web-4.2.6.RELEASE.jar:4.2.6.RELEASE]
  18.     at org.springframework.web.filter.GenericFilterBean.init(GenericFilterBean.java:199) ~[spring-web-4.2.6.RELEASE.jar:4.2.6.RELEASE]
  19.     at org.apache.catalina.core.ApplicationFilterConfig.initFilter(ApplicationFilterConfig.java:279) ~[tomcat-embed-core-8.0.33.jar:8.0.33]
  20.     at org.apache.catalina.core.ApplicationFilterConfig.<init>(ApplicationFilterConfig.java:109) ~[tomcat-embed-core-8.0.33.jar:8.0.33]
  21.     at org.apache.catalina.core.StandardContext.filterStart(StandardContext.java:4658) [tomcat-embed-core-8.0.33.jar:8.0.33]
  22.     at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5277) [tomcat-embed-core-8.0.33.jar:8.0.33]
  23.     at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) [tomcat-embed-core-8.0.33.jar:8.0.33]
  24.     at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1408) [tomcat-embed-core-8.0.33.jar:8.0.33]
  25.     at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1398) [tomcat-embed-core-8.0.33.jar:8.0.33]
  26.     at java.util.concurrent.FutureTask.run(FutureTask.java:266) [na:1.8.0_73]
  27.     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [na:1.8.0_73]
  28.     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [na:1.8.0_73]
  29.     at java.lang.Thread.run(Thread.java:745) [na:1.8.0_73]
  30. Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is java.util.regex.PatternSyntaxException: Dangling meta character '*' near index 6
  31. /api/**
  32.       ^
  33.     at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:189) ~[spring-beans-4.2.6.RELEASE.jar:4.2.6.RELEASE]
  34.     at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:588) ~[spring-beans-4.2.6.RELEASE.jar:4.2.6.RELEASE]
  35.     ... 23 common frames omitted
  36. Caused by: java.util.regex.PatternSyntaxException: Dangling meta character '*' near index 6
  37. /api/**
  38.       ^
  39.     at java.util.regex.Pattern.error(Pattern.java:1955) ~[na:1.8.0_73]
  40.     at java.util.regex.Pattern.sequence(Pattern.java:2123) ~[na:1.8.0_73]
  41.     at java.util.regex.Pattern.expr(Pattern.java:1996) ~[na:1.8.0_73]
  42.     at java.util.regex.Pattern.compile(Pattern.java:1696) ~[na:1.8.0_73]
  43.     at java.util.regex.Pattern.<init>(Pattern.java:1351) ~[na:1.8.0_73]
  44.     at java.util.regex.Pattern.compile(Pattern.java:1028) ~[na:1.8.0_73]
  45.     at org.springframework.security.web.util.matcher.RegexRequestMatcher.<init>(RegexRequestMatcher.java:68) ~[spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
  46.     at org.springframework.security.web.util.matcher.RegexRequestMatcher.<init>(RegexRequestMatcher.java:52) ~[spring-security-web-4.0.4.RELEASE.jar:4.0.4.RELEASE]
  47.     at com.hnu.tutorial.configs.SecurityConfig$CsrfSecurityRequestMatcher.<init>(SecurityConfig.java:35) ~[classes/:na]
  48.     at com.hnu.tutorial.configs.SecurityConfig.configure(SecurityConfig.java:27) ~[classes/:na]
  49.     at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.getHttp(WebSecurityConfigurerAdapter.java:199) ~[spring-security-config-4.0.4.RELEASE.jar:4.0.4.RELEASE]
  50.     at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.init(WebSecurityConfigurerAdapter.java:290) ~[spring-security-config-4.0.4.RELEASE.jar:4.0.4.RELEASE]
  51.     at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.init(WebSecurityConfigurerAdapter.java:67) ~[spring-security-config-4.0.4.RELEASE.jar:4.0.4.RELEASE]
  52.     at com.hnu.tutorial.configs.SecurityConfig$$EnhancerBySpringCGLIB$$db9c0de0.init(<generated>) ~[classes/:na]
  53.     at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.init(AbstractConfiguredSecurityBuilder.java:370) ~[spring-security-config-4.0.4.RELEASE.jar:4.0.4.RELEASE]
  54.     at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.doBuild(AbstractConfiguredSecurityBuilder.java:324) ~[spring-security-config-4.0.4.RELEASE.jar:4.0.4.RELEASE]
  55.     at org.springframework.security.config.annotation.AbstractSecurityBuilder.build(AbstractSecurityBuilder.java:41) ~[spring-security-config-4.0.4.RELEASE.jar:4.0.4.RELEASE]
  56.     at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.springSecurityFilterChain(WebSecurityConfiguration.java:105) ~[spring-security-config-4.0.4.RELEASE.jar:4.0.4.RELEASE]
  57.     at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$$EnhancerBySpringCGLIB$$5dd0484b.CGLIB$springSecurityFilterChain$4(<generated>) ~[spring-security-config-4.0.4.RELEASE.jar:4.0.4.RELEASE]
  58.     at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$$EnhancerBySpringCGLIB$$5dd0484b$$FastClassBySpringCGLIB$$a796ba38.invoke(<generated>) ~[spring-security-config-4.0.4.RELEASE.jar:4.0.4.RELEASE]
  59.     at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:228) ~[spring-core-4.2.6.RELEASE.jar:4.2.6.RELEASE]
  60.     at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:356) ~[spring-context-4.2.6.RELEASE.jar:4.2.6.RELEASE]
  61.     at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$$EnhancerBySpringCGLIB$$5dd0484b.springSecurityFilterChain(<generated>) ~[spring-security-config-4.0.4.RELEASE.jar:4.0.4.RELEASE]
  62.     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_73]
  63.     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_73]
  64.     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_73]
  65.     at java.lang.reflect.Method.invoke(Method.java:497) ~[na:1.8.0_73]
  66.     at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:162) ~[spring-beans-4.2.6.RELEASE.jar:4.2.6.RELEASE]
  67.     ... 24 common frames omitted

型
上面的日志显示正则表达式/api/**在

  1. private RegexRequestMatcher unprotectedMatcher = new RegexRequestMatcher("/api/**", null);

型
有Dangling meta character '*' near index 6 /api/**。但我不知道这个错误是什么意思。

spring-boot

4条答案

按热度按时间
xpszyzbs

xpszyzbs1#

对于那些有如何禁用特定路径的CSRF验证的问题的人，我发现最简单的方法是创建一个具有模式的String数组，如下所示：

  1. String [] publicUrls = new String [] {
  2.             "/public/**",
  3.             "/login",
  4.             "/logout"
  5.     };

字符串
下面是我在CSRF中使用的代码。忽略URL的代码是.ignoringAntMatchers(publicUrls)：

  1. .csrf()
  2.         .csrfTokenRepository(csrfTokenRepository())
  3.         .ignoringAntMatchers(publicUrls)

型
我发现这个here。

展开查看全部
赞(0）分享  回复(0）举报  2024-01-06
ntjbwcob

ntjbwcob2#

尝试以下操作以允许API调用绕过CSRF检查。

  1. final String API_URL = "/api/*";
  2. http.csrf()
  3.     .requireCsrfProtectionMatcher(new RequestMatcher() {
  4.         private RegexRequestMatcher requestMatcher = new RegexRequestMatcher(API_URL, null);
  6.         @Override
  7.         public boolean matches(HttpServletRequest request) {
  8.             return !requestMatcher.matches(request);
  9.         }
  10.     })
  11.     .csrfTokenRepository(csrfTokenRepository());

字符串

赞(0）分享  回复(0）举报  2024-01-06
mzmfm0qo

mzmfm0qo3#

在最新版本的Sping Boot 中，可以通过配置HttpSecurity对象创建SecurityFilterChain来禁用特定URL的CSRF保护。

  1. @Bean
  2.     public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
  3.         httpSecurity.csrf((csrf) -> csrf.ignoringRequestMatchers("/trade/nextitems", "/trade/item/**")).build();
  5. }

字符串

赞(0）分享  回复(0）举报  2024-01-06
z2acfund

z2acfund4#

虽然我不知道如何使用RegexRequestMatcher匹配未受保护的URL模式，但我找到了另一种解决方案。下面的方法对我来说很好：

  1. @Override
  2.     protected void configure(HttpSecurity http) throws Exception {
  4.         RequestMatcher csrfRequestMatcher = new RequestMatcher() {
  6.             // Enabled CSFR protection on the following urls:
  7.             private AntPathRequestMatcher[] disableCsrfMatchers = {
  8.                     new AntPathRequestMatcher("/api/**")
  9.             };
  11.             @Override
  12.             public boolean matches(HttpServletRequest request) {
  13.                 // If the request match one url the CSFR protection will not be enabled
  14.                 for (AntPathRequestMatcher rm : disableCsrfMatchers) {
  15.                     if (rm.matches(request)) {
  16.                         return false;
  17.                     }
  18.                 }
  19.                 return true;
  20.             } // method matches
  22.         };
  24.         http.csrf().requireCsrfProtectionMatcher(csrfRequestMatcher).and()
  25.                 .authorizeRequests().antMatchers("/**").permitAll().anyRequest().fullyAuthenticated();
  26.     }

字符串

展开查看全部
赞(0）分享  回复(0）举报  2024-01-06
我来回答

相关问题

    查看更多

    热门标签

    更多
    JavaquerypythonNode开发语言requestUtil数据库Table后端算法LoggerMessageElementParser

    最新问答

    更多
    • 蜀ICP备13028337号-1 大数据知识库 https://www.saoniuhuo.com © All rights reserved
    • 本站内容来源互联网,如果侵犯您的权益请联系我们删除, 联系方式：448109455@qq.com