DWR CSRF Security Error

转载 2012年03月30日 14:36:37

错误描述:

org.directwebremoting.dwrp.BaseDwrpHandler - A request has been denied as a potential CSRF attack.
org.directwebremoting.dwrp.BaseCallHandler - Exception while processing batch
java.lang.SecurityException: CSRF Security Error

  at org.directwebremoting.dwrp.BaseDwrpHandler.checkNotCsrfAttack(BaseDwrpHandler.java:85)
  at org.directwebremoting.dwrp.BaseCallHandler.handle(BaseCallHandler.java:76)
  at org.directwebremoting.servlet.UrlProcessor.handle(UrlProcessor.java:120)
  at org.directwebremoting.servlet.DwrServlet.doPost(DwrServlet.java:141)
  at javax.servlet.http.HttpServlet.service(HttpServlet.java:710)
  at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
  at org.apache.struts2.dispatcher.ActionContextCleanUp.doFilter(ActionContextCleanUp.java:99)
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
  at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:230)
  at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
  at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
  at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:104)
  at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
  at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:261)
  at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)
  at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process  (Http11Protocol.java:581)
  at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
  at java.lang.Thread.run(Thread.java:619)

 

解决办法:

修改 web.xml 中 DWR 配置信息

原:

<servlet> 
      <servlet-name>dwr-invoker</servlet-name> 
     <servlet-class>org.directwebremoting.spring.DwrSpringServlet</servlet-class> 
     <init-param>
      <param-name>debug</param-name>
      <param-value>true</param-value>
  </init-param>
</servlet>

 

加入跨域调用配置信息(红色部分),修改为:

<servlet> 
      <servlet-name>dwr-invoker</servlet-name> 
      <servlet-class>org.directwebremoting.spring.DwrSpringServlet</servlet-class> 
      <init-param>
             <param-name>debug</param-name>
             <param-value>true</param-value>
      </init-param>
      <init-param>
             <param-name>crossDomainSessionSecurity</param-name>
             <param-value>false</param-value>
      </init-param>
      <init-param>
            <param-name>allowScriptTagRemoting</param-name>
            <param-value>true</param-value>
      </init-param>

</servlet>

相关文章推荐

dwr:A request has been denied as a potential CSRF attack.错误的解决

dwr遇到这种错误:  org.directwebremoting.util.CommonsLoggingOutput error  严重: A request has been denied a...

dwr:A request has been denied as a potential CSRF attack.

org.directwebremoting.util.CommonsLoggingOutput error 严重: A request has been denied as a potential ...

Spring Security csrf学习

什么是csrf? csrf又称跨域请求伪造,攻击方通过伪造用户请求访问受信任站点。CSRF这种攻击方式在2000年已经被国外的安全人员提出,但在国内,直到06年才开始被关注,08年,国内外的多个大型...

spring-security中的csrf防御机制

什么是csrf?

利用spring-security解决CSRF问题

从配置到原理,一步步讲解如何利用Spring的security框架来处理scrf问题。

spring-security中的csrf防御机制

什么是csrf? csrf又称跨域请求伪造,攻击方通过伪造用户请求访问受信任站点。CSRF这种攻击方式在2000年已经被国外的安全人员提出,但在国内,直到06年才开始被关注,08年,国内外的多个大型社...

Error: invalid csrf token

版权所有:一介布衣  原文地址:http://yijiebuyi.com/blog/74528e6546834ebfec47daf4e222d621.html  无特别说明均为原创,欢迎各种形式转...

使用DWR前台页面跳出session error的对话框

使用DWR前台页面跳出session error的对话框 而控制台则输出: 2007-5-29 11:58:53 org.directwebremoting.util.CommonsLogging...
内容举报
返回顶部
收藏助手
不良信息举报
您举报文章:深度学习:神经网络中的前向传播和反向传播算法推导
举报原因:
原因补充:

(最多只允许输入30个字)