spring security 跨域防伪攻击

applicationContext-security.xml中配置

 <http use-expressions="true" disable-url-rewriting="false" entry-point-ref="loginUrlAuthenticationEntryPoint">
         <!-- <intercept-url pattern="/resources/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/> -->
         <intercept-url pattern="/login" access="IS_AUTHENTICATED_ANONYMOUSLY" />
         <intercept-url pattern="/logincheck" access="IS_AUTHENTICATED_ANONYMOUSLY" />
         <intercept-url pattern="/error/accessdenied*" access="IS_AUTHENTICATED_ANONYMOUSLY" />
         <!-- <intercept-url pattern="/messagecode/getimagecode*" access="IS_AUTHENTICATED_ANONYMOUSLY"/> -->
 7         <!-- 跨站请求伪造 -->
 8         <csrf />
         <access-denied-handler ref="accessDeniedHandler"/>

         <intercept-url pattern="/**" access="isAuthenticated()" />

         <session-management session-authentication-strategy-ref="sas" />
         <!-- 登出 -->
         <logout invalidate-session="true" logout-success-url="/login" logout-url="/logout" />
         <!-- 登录 -->
         <custom-filter ref="loginAuthenticationFilter" position="FORM_LOGIN_FILTER" />

         <custom-filter ref="concurrencyFilter" position="CONCURRENT_SESSION_FILTER" />

         <custom-filter ref="mySecurityFilter" before="FILTER_SECURITY_INTERCEPTOR" />
         <!-- 切换微信公众号 -->
         <custom-filter ref="switchWxUserFilter" position="SWITCH_USER_FILTER" />

     </http>

详细可查spring官网csrf。。。

spring的form:form表单点击提交是，spring会为表单元素自动加上防伪标签，上传文件是相当于提交两次form表单，因此还需手动再加一次。