diff --git a/README.md b/README.md index e32e9b2e..1e8d2130 100644 --- a/README.md +++ b/README.md @@ -25,6 +25,7 @@ - [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/JSONP.java) - [SPEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SPEL.java) - [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback.xml) +- [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CSRF.java) ## 漏洞说明 @@ -36,6 +37,7 @@ - [CSRF](https://github.com/JoyChou93/java-sec-code/wiki/CSRF) - [JSONP](https://github.com/JoyChou93/java-sec-code/wiki/JSONP) - [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/wiki/Actuators-to-RCE) +- [CSRF](https://github.com/JoyChou93/java-sec-code/wiki/CSRF) - [Others](https://github.com/JoyChou93/java-sec-code/wiki/others) diff --git a/java-sec-code.iml b/java-sec-code.iml index 2cf50e4e..121c97a1 100644 --- a/java-sec-code.iml +++ b/java-sec-code.iml @@ -12,7 +12,7 @@ - + @@ -41,7 +41,6 @@ - @@ -55,11 +54,7 @@ - - - - @@ -125,7 +120,6 @@ - @@ -165,5 +159,15 @@ + + + + + + + + + + \ No newline at end of file diff --git a/pom.xml b/pom.xml index b2aa7838..ea72cdf6 100644 --- a/pom.xml +++ b/pom.xml @@ -136,6 +136,25 @@ 3.1.4 + + + org.springframework.security + spring-security-web + 4.2.12.RELEASE + + + + org.springframework.security + spring-security-config + 4.2.12.RELEASE + + + + org.springframework.boot + spring-boot-starter-security + 2.1.5.RELEASE + + diff --git a/src/main/java/org/joychou/Application.java b/src/main/java/org/joychou/Application.java index 3b05f723..8749342a 100644 --- a/src/main/java/org/joychou/Application.java +++ b/src/main/java/org/joychou/Application.java @@ -8,7 +8,7 @@ @SpringBootApplication -@EnableEurekaClient +// @EnableEurekaClient // 测试Eureka请打开注释，防止控制台一直有warning public class Application extends SpringBootServletInitializer { @Override diff --git a/src/main/java/org/joychou/WebSecurityConfig.java b/src/main/java/org/joychou/WebSecurityConfig.java new file mode 100644 index 00000000..76addad7 --- /dev/null +++ b/src/main/java/org/joychou/WebSecurityConfig.java @@ -0,0 +1,20 @@ +package org.joychou; + +import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; +import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; +import org.springframework.security.web.csrf.CookieCsrfTokenRepository; + +@EnableWebSecurity +@Configuration +public class WebSecurityConfig extends WebSecurityConfigurerAdapter { + + @Override + protected void configure(HttpSecurity http) throws Exception { + // http.csrf().disable() // 去掉csrf校验 + // 默认token存在session里，现在改为token存在cookie里。但存在后端多台服务器情况，session不能同步的问题，所以一般使用cookie模式。 + http.csrf().csrfTokenRepository(new CookieCsrfTokenRepository()); + // http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()); + } +} \ No newline at end of file diff --git a/src/main/java/org/joychou/controller/CSRF.java b/src/main/java/org/joychou/controller/CSRF.java new file mode 100644 index 00000000..ebef75c8 --- /dev/null +++ b/src/main/java/org/joychou/controller/CSRF.java @@ -0,0 +1,31 @@ +package org.joychou.controller; + +import org.springframework.stereotype.Controller; +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.PostMapping; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.ResponseBody; + +/** + * @author: JoyChou (joychou@joychou.org) + * @date: 2019.05.31 + * @desc: check csrf using spring-security + * @using: access http://localhost:8080/csrf/ -> click submit + */ + + +@Controller +@RequestMapping("/csrf") +public class CSRF { + + @GetMapping("/") + public String index() { + return "csrfTest"; + } + + @PostMapping("/post") + @ResponseBody + public String post() { + return "CSRF passed."; + } +} diff --git a/src/main/java/org/joychou/controller/Test.java b/src/main/java/org/joychou/controller/Test.java new file mode 100644 index 00000000..b7374f1d --- /dev/null +++ b/src/main/java/org/joychou/controller/Test.java @@ -0,0 +1,25 @@ +package org.joychou.controller; + +import org.springframework.stereotype.Controller; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.ResponseBody; + +import javax.servlet.http.Cookie; +import javax.servlet.http.HttpServletResponse; + +@Controller +@RequestMapping("/test") +public class Test { + + @RequestMapping(value = "/") + @ResponseBody + private String Index(HttpServletResponse response) { + + Cookie cookie = new Cookie("XSRF-TOKEN", "123"); + cookie.setDomain("taobao.com"); + cookie.setMaxAge(-1); // forever time + response.addCookie(cookie); + return "success"; + } + +} diff --git a/src/main/resources/templates/csrfTest.html b/src/main/resources/templates/csrfTest.html new file mode 100644 index 00000000..b2916c8d --- /dev/null +++ b/src/main/resources/templates/csrfTest.html @@ -0,0 +1,27 @@ + + + + + + +
+
+ + +
+
+ + + + + + + + + + + + + + + \ No newline at end of file