Spring Security笔记：解决CsrfFilter与Rest服务Post方式的矛盾

基于Spring Security+Spring MVC的web应用，为了防止跨站提交攻击，通常会配置csrf，即：

     <http ...>
         ...
         <csrf />
     </http>

如果应用中有Post方式访问的Rest服务(参考下面的代码)，会很不幸的发现，所有POST方式请求的服务会调用失败。

     @RequestMapping(value = "/user/create", method = RequestMethod.POST)
     @ResponseBody
     public UserInfo createUser(@RequestBody(required = true) UserInfo user,
             HttpServletRequest request, HttpServletResponse response)
             throws Exception {
         ...
     }

原因在于：启用csrf后，所有http请求都被会CsrfFilter拦截，而CsrfFilter中有一个私有类DefaultRequiresCsrfMatcher

     private static final class DefaultRequiresCsrfMatcher implements RequestMatcher {
         private Pattern allowedMethods = Pattern.compile("^(GET|HEAD|TRACE|OPTIONS)$");

         /* (non-Javadoc)
          * @see org.springframework.security.web.util.matcher.RequestMatcher#matches(javax.servlet.http.HttpServletRequest)
          */
         public boolean matches(HttpServletRequest request) {
             return !allowedMethods.matcher(request.getMethod()).matches();
         }
     }

从这段源码可以发现，POST方法被排除在外了，也就是说只有GET|HEAD|TRACE|OPTIONS这4类方法会被放行，其它Method的http请求，都要验证_csrf的token是否正确，而通常post方式调用rest服务时，又没有_csrf的token，所以校验失败。

解决方法：自己弄一个Matcher

 package com.cnblogs.yjmyzz.utils;

 import java.util.List;
 import java.util.regex.Pattern;

 import javax.servlet.http.HttpServletRequest;

 import org.springframework.security.web.util.matcher.RequestMatcher;

 public class CsrfSecurityRequestMatcher implements RequestMatcher {
     private Pattern allowedMethods = Pattern
             .compile("^(GET|HEAD|TRACE|OPTIONS)$");

     public boolean matches(HttpServletRequest request) {

         if (execludeUrls != null && execludeUrls.size() > 0) {
             String servletPath = request.getServletPath();
             for (String url : execludeUrls) {
                 if (servletPath.contains(url)) {
                     return false;
                 }
             }
         }
         return !allowedMethods.matcher(request.getMethod()).matches();
     }

     /**
      * 需要排除的url列表
      */
     private List<String> execludeUrls;

     public List<String> getExecludeUrls() {
         return execludeUrls;
     }

     public void setExecludeUrls(List<String> execludeUrls) {
         this.execludeUrls = execludeUrls;
     }
 }

这里添加了一个属性execludeUrls，允许人为排除哪些url。

然后在配置文件里，这样修改：

     <http entry-point-ref="loginEntryPoint" use-expressions="true">
         ...
         <intercept-url pattern="/rest/**" access="permitAll" />
         ...
         <csrf request-matcher-ref="csrfSecurityRequestMatcher"/>
     </http>

     <beans:bean id="csrfSecurityRequestMatcher" class="com.cnblogs.yjmyzz.utils.CsrfSecurityRequestMatcher">
         <beans:property name="execludeUrls">
             <beans:list>
                 <beans:value>/rest/</beans:value>
             </beans:list>
         </beans:property>
     </beans:bean>

这里约定所有/rest/开头的都是Rest服务地址，上面的配置就把/rest/排除在csrf验证的范围之外了.