SpringSecurity中的CSRF在工作中的使用方式

JuniperLibrary · Apr 11, 2022 · 0691229 · 0691229
1 parent a239d8c
commit 0691229
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 4 deletions.
diff --git a/src/main/java/com/uin/config/SpringSecurityConfig.java b/src/main/java/com/uin/config/SpringSecurityConfig.java
@@ -54,7 +54,8 @@ protected void configure(HttpSecurity http) throws Exception {
                 .passwordParameter("pwd")
 
                 //2. 必须和表单的提交是一样的
-                .loginProcessingUrl("/login")
+                //.loginProcessingUrl("/login")
+                .loginProcessingUrl("/showLogin")
                 //自定义登陆页面
                 .loginPage("/login.html")
 
@@ -131,7 +132,7 @@ protected void configure(HttpSecurity http) throws Exception {
 
 
         //关闭防火墙
-        http.csrf().disable();
+        //http.csrf().disable();
 
 
         //自定义403 权限异常

diff --git a/src/main/java/com/uin/controller/LoginController.java b/src/main/java/com/uin/controller/LoginController.java
@@ -90,4 +90,16 @@ public String toError() {
     public String demo() {
         return "demo";
     }
+
+    /**
+     * CSRF的页面跳转
+     *
+     * @return java.lang.String
+     * @author wanglufei
+     * @date 2022/4/11 4:35 PM
+     */
+    @RequestMapping("showLogin")
+    public String showLogin() {
+        return "login";
+    }
 }
diff --git a/src/main/resources/templates/login.html b/src/main/resources/templates/login.html
@@ -1,14 +1,14 @@
 <!DOCTYPE html>
 <html lang="en" xmlns="http://www.w3.org/1999/xhtml"
-      xmlns:th="http://www.thymeleaf.org"
-      xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity5 ">
+      xmlns:th="http://www.thymeleaf.org">
 <head>
     <meta charset="UTF-8">
     <title>login</title>
 </head>
 <body>
 
 <form action="/login" method="post">
+    <input type="hidden" th:value="${_csrf.token}" name="_csrf" th:if="${_csrf}">
     用户名：<input type="text" name="username" placeholder="请输入用户名">
     用户名：<input type="text" name="username" placeholder="请输入用户名">