在postman中请求的接口有csrf怎么办

今天在写项目的时候,写了一个post接口,为了防止crsf攻击,config.defalut.js文件中加了如下代码:

exports.security = {
  csrf: {
    ignoreJSON: false
  }
};

这会导致在postman中请求接口失败,报403.

只需要把config.default.js文件的这里改为:

exports.security = {
  csrf: {
    enable: false,
    ignoreJSON: false
  }
};

 

转载于:https://www.cnblogs.com/kaiqinzhang/p/11284445.html

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
Spring Security提供了多种方式来实现接口的登录,其常见的方式是使用token认证。以下是一个简单的示例: 1. 配置Spring Security 在Spring Security的配置文件,需要配置一个TokenAuthenticationFilter来处理token认证。具体如下: ```java @Configuration @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private JwtTokenProvider jwtTokenProvider; @Override protected void configure(HttpSecurity http) throws Exception { http.csrf().disable() .authorizeRequests() .antMatchers("/login").permitAll() .anyRequest().authenticated() .and() .apply(new JwtConfigurer(jwtTokenProvider)); } @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } @Bean public JwtTokenProvider jwtTokenProvider() { return new JwtTokenProvider(); } @Bean public TokenAuthenticationFilter jwtAuthenticationTokenFilter() throws Exception { return new TokenAuthenticationFilter(); } } ``` 2. 创建TokenAuthenticationFilter TokenAuthenticationFilter是一个过滤器,用于在请求读取并验证token。具体如下: ```java public class TokenAuthenticationFilter extends OncePerRequestFilter { @Autowired private JwtTokenProvider jwtTokenProvider; @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { String token = jwtTokenProvider.resolveToken(request); if (token != null && jwtTokenProvider.validateToken(token)) { Authentication auth = jwtTokenProvider.getAuthentication(token); if (auth != null) { SecurityContextHolder.getContext().setAuthentication(auth); } } filterChain.doFilter(request, response); } } ``` 3. 创建JwtTokenProvider JwtTokenProvider用于生成和验证token。具体如下: ```java public class JwtTokenProvider { private static final String SECRET_KEY = "secret_key"; private static final long EXPIRATION_TIME = 864_000_000; // 10 days private static final String TOKEN_PREFIX = "Bearer "; private static final String HEADER_STRING = "Authorization"; public String createToken(String username) { Claims claims = Jwts.claims().setSubject(username); Date now = new Date(); Date validity = new Date(now.getTime() + EXPIRATION_TIME); return Jwts.builder() .setClaims(claims) .setIssuedAt(now) .setExpiration(validity) .signWith(SignatureAlgorithm.HS256, SECRET_KEY) .compact(); } public Authentication getAuthentication(String token) { String username = getUsername(token); User user = userService.loadUserByUsername(username); return new UsernamePasswordAuthenticationToken(user, "", user.getAuthorities()); } public String getUsername(String token) { return Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token).getBody().getSubject(); } public boolean validateToken(String token) { try { Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token); return true; } catch (SignatureException | MalformedJwtException | ExpiredJwtException | UnsupportedJwtException | IllegalArgumentException ex) { return false; } } public String resolveToken(HttpServletRequest request) { String bearerToken = request.getHeader(HEADER_STRING); if (bearerToken != null && bearerToken.startsWith(TOKEN_PREFIX)) { return bearerToken.substring(TOKEN_PREFIX.length()); } return null; } } ``` 4. 创建登录接口 在登录接口,需要调用JwtTokenProvider.createToken方法生成token,并将token返回给客户端。具体如下: ```java @RestController public class LoginController { @Autowired private JwtTokenProvider jwtTokenProvider; @PostMapping("/login") public ResponseEntity<?> login(@RequestBody LoginRequest loginRequest) { Authentication authentication = authenticationManager.authenticate( new UsernamePasswordAuthenticationToken( loginRequest.getUsername(), loginRequest.getPassword() ) ); SecurityContextHolder.getContext().setAuthentication(authentication); String token = jwtTokenProvider.createToken(loginRequest.getUsername()); return ResponseEntity.ok(new JwtResponse(token)); } } ``` 5. 测试接口 使用Postman等工具发送请求,将生成的token放入请求,即可访问需要登录后才能访问的接口
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值