CSRF防御实例记录

• 项目使用SpringMVC+Freemarker

• 创建令牌生产类-(CSRFTokenManager)

  
  import java.util.UUID;
  
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpSession;
  
  /**
   * @author huangzy
   * @version $Revision: 1.0 $, $Date: 2019年10月25日 下午4:30:43 $
   */
  public class CSRFTokenManager {
  
      /**
       * The token parameter name
       */
      static final String CSRF_PARAM_NAME = "CSRFToken";
  
      /**
       * The location on the session which stores the token
       */
      public static final String CSRF_TOKEN_FOR_SESSION_ATTR_NAME = CSRFTokenManager.class.getName() + ".tokenval";
  
      public static String getTokenForSession(HttpSession session) {
          String token = null;
  
          synchronized (session) {
              token = (String) session.getAttribute(CSRF_TOKEN_FOR_SESSION_ATTR_NAME);
              if (null == token) {
                  token = UUID.randomUUID().toString();
                  session.setAttribute(CSRF_TOKEN_FOR_SESSION_ATTR_NAME, token);
              }
          }
          return token;
      }
  
      /**
       * Extracts the token value from the session
       *
       * @param request
       * @return
       */
      public static String getTokenFromRequest(HttpServletRequest request) {
          return request.getParameter(CSRF_PARAM_NAME);
      }
  
      private CSRFTokenManager() {
      };
  
  }

  ---

   

• 在baseController中把令牌放入到model中

  public class BaseController{
      @ModelAttribute
      public void initBase(HttpServletRequest request, Ht