CSRF漏洞防御

最新推荐文章于 2024-10-05 06:00:00 发布

令狐V乱冲

最新推荐文章于 2024-10-05 06:00:00 发布

阅读量1.5k

点赞数

分类专栏：技术文章文章标签： csrf csrf漏洞 csrf防御

本文链接：https://blog.csdn.net/u013520425/article/details/84103645

版权

技术文章专栏收录该内容

3 篇文章 0 订阅

订阅专栏

最近项目扫描到csrf漏洞，记录一下解决方法，其实很简单，就是验证请求头的referer.

第一步，写filter类

package com.zjh.filter;

import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class CSRFFilter implements Filter {
    public CSRFFilter() {
    }

    public void destroy() {
    }

    public void doFilter(ServletRequest request0, ServletResponse response0, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest)request0;
        HttpServletResponse res = (HttpServletResponse)response0;
        String referer = req.getHeader("referer");
        StringBuffer stringBuffer = new StringBuffer();
        stringBuffer.append(req.getScheme()).append("://").append(req.getServerName());
        if (referer != null && !"".equals(referer)) {
            if (referer.lastIndexOf(String.valueOf(stringBuffer)) != 0) {
                res.sendError(400);
            } else {
                chain.doFilter(req, res);
            }
        } else {
            res.sendError(400);
        }
    }

    public void init(FilterConfig arg0) throws ServletException {
    }
}

第二步，在web.xml配置过滤器

<!-- CSRF防御开始-->
	<filter>
		<filter-name>CSRFFilter</filter-name>
		<filter-class>com.zjh.filter.CSRFFilter</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>CSRFFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
	<!-- CSRF防御结束-->