使用SpringSecurity处理CSRF攻击的方法步骤

<!-- 模板引擎 freemarker --><dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-freemarker</artifactId></dependency><!-- Security (只使用CSRF部分) --><dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-web</artifactId></dependency>

@SpringBootApplicationpublic class Application { public static void main(String[] args) {  SpringApplication.run(Application.class, args); }  /**  * 配置CSRF过滤器  *  * @return {@link org.springframework.boot.web.servlet.FilterRegistrationBean}  */ @Bean public FilterRegistrationBean<CsrfFilter> csrfFilter() {  FilterRegistrationBean<CsrfFilter> registration = new FilterRegistrationBean<>();  registration.setFilter(new CsrfFilter(new HttpSessionCsrfTokenRepository()));  registration.addUrlPatterns("/*");  registration.setName("csrfFilter");  return registration; }}

<input name="${(_csrf.parameterName)!}" value="${(_csrf.token)!}" type="hidden" />

xhr.setRequestHeader("${_csrf.headerName}", "${_csrf.token}");

jQuery.ajaxSetup({ "beforeSend": function (request) {  request.setRequestHeader("${_csrf.headerName}", "${_csrf.token}"); }});