spring security 详解-优快云博客

本文链接：https://blog.youkuaiyun.com/knight_black_bob/article/details/88223745

本文详细介绍了Spring Security中CSRF保护的配置方法，包括如何设置排除URL、自定义请求匹配器等高级用法，并展示了完整的spring-security.xml配置文件示例。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

spring security 详解

spring-security.xml

<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans
      http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
      http://www.springframework.org/schema/security
      http://www.springframework.org/schema/security/spring-security-4.0.xsd ">
	
    <http pattern="/login" security="none"/>  
    
	<http auto-config="true">
	<headers>
        <frame-options policy="SAMEORIGIN"/>
    </headers>
		<http-basic />
		<csrf request-matcher-ref="csrfSecurityRequestMatcher"/>
	</http>

    
    <beans:bean id="csrfSecurityRequestMatcher" class="com.curiousby.csrf.CsrfSecurityRequestMatcher">
        <beans:property name="execludeUrls">
            <beans:list>
               <beans:value>/test/</beans:value>
               <beans:value>/index/</beans:value>
            </beans:list>
        </beans:property>
    </beans:bean>
	<authentication-manager>
	</authentication-manager>
 
</beans:beans>

/*
 * Project: .web
 * 
 * File Created at 2017年3月15日
 * 
 * Copyright 2016  Corporation Limited.
 * All rights reserved.
 *
 * This software is the confidential and proprietary information of
 * curiousby Company. ("Confidential Information").  You shall not
 * disclose such Confidential Information and shall use it only in
 * accordance with the terms of the license.
 */
package com.curiousby.csrf;

import java.util.List;
import java.util.regex.Pattern;

import javax.servlet.http.HttpServletRequest;

import org.springframework.security.web.util.matcher.RequestMatcher;

/**
 * @see com.curiousby.csrf.CsrfSecurityRequestMatcher
 * @Type CsrfSecurityRequestMatcher.java
 * @Desc 
 * @author baoyou curiousby@163.com
 * @date 2017年3月15日 下午3:44:57
 * @version 
 */
public class CsrfSecurityRequestMatcher implements RequestMatcher {
    private Pattern allowedMethods = Pattern.compile("^(GET|HEAD|TRACE|OPTIONS)$");

    @Override
    public boolean matches(HttpServletRequest request) {

        if (execludeUrls != null && execludeUrls.size() > 0) {
            String servletPath = request.getServletPath();
            for (String url : execludeUrls) {
                if ("POST".equals(request.getMethod())) {
                    if (servletPath.contains(url)) {
                        System.out.println("---------排除掉的post方法--------" + servletPath);
                        return false;
                    }
                }
            }
        }
        return !allowedMethods.matcher(request.getMethod()).matches();
    }

    /**
     * 需要排除的url列表
     */
    private List<String> execludeUrls;

    public List<String> getExecludeUrls() {
        return execludeUrls;
    }

    public void setExecludeUrls(List<String> execludeUrls) {
        this.execludeUrls = execludeUrls;
    }
}

/**
 * Revision history
 * -------------------------------------------------------------------------
 * 
 * Date Author Note
 * -------------------------------------------------------------------------
 * 2017年3月15日 baoyou curiousby@163.com creat
 */

web.xml

	<filter>
		<filter-name>springSecurityFilterChain</filter-name>
		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>springSecurityFilterChain</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>