正文
spring security 跨域防伪攻击
提示：扫一扫查出行【扫一扫了解最新限行尾号】
复制提示
applicationContext-security.xml中配置
<http use-expressions="true" disable-url-rewriting="false" entry-point-ref="loginUrlAuthenticationEntryPoint">
<!-- <intercept-url pattern="/resources/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/> -->
<intercept-url pattern="/login" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<intercept-url pattern="/logincheck" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<intercept-url pattern="/error/accessdenied*" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<!-- <intercept-url pattern="/messagecode/getimagecode*" access="IS_AUTHENTICATED_ANONYMOUSLY"/> -->
7 <!-- 跨站请求伪造 -->
8 <csrf />
<access-denied-handler ref="accessDeniedHandler"/> <intercept-url pattern="/**" access="isAuthenticated()" /> <session-management session-authentication-strategy-ref="sas" />
<!-- 登出 -->
<logout invalidate-session="true" logout-success-url="/login" logout-url="/logout" />
<!-- 登录 -->
<custom-filter ref="loginAuthenticationFilter" position="FORM_LOGIN_FILTER" /> <custom-filter ref="concurrencyFilter" position="CONCURRENT_SESSION_FILTER" /> <custom-filter ref="mySecurityFilter" before="FILTER_SECURITY_INTERCEPTOR" />
<!-- 切换微信公众号 -->
<custom-filter ref="switchWxUserFilter" position="SWITCH_USER_FILTER" /> </http>
详细可查spring官网csrf。。。
spring的form:form表单点击提交是，spring会为表单元素自动加上防伪标签，上传文件是相当于提交两次form表单，因此还需手动再加一次。
