spring security 跨域防伪攻击

applicationContext-security.xml中配置

 1 <http use-expressions="true" disable-url-rewriting="false" entry-point-ref="loginUrlAuthenticationEntryPoint">
 2         <!-- <intercept-url pattern="/resources/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/> -->
 3         <intercept-url pattern="/login" access="IS_AUTHENTICATED_ANONYMOUSLY" />
 4         <intercept-url pattern="/logincheck" access="IS_AUTHENTICATED_ANONYMOUSLY" />
 5         <intercept-url pattern="/error/accessdenied*" access="IS_AUTHENTICATED_ANONYMOUSLY" />
 6         <!-- <intercept-url pattern="/messagecode/getimagecode*" access="IS_AUTHENTICATED_ANONYMOUSLY"/> -->
 7         <!-- 跨站请求伪造 -->
 8         <csrf />
 9         <access-denied-handler ref="accessDeniedHandler"/>
10 
11         <intercept-url pattern="/**" access="isAuthenticated()" />
12 
13         <session-management session-authentication-strategy-ref="sas" />
14         <!-- 登出 -->
15         <logout invalidate-session="true" logout-success-url="/login" logout-url="/logout" />
16         <!-- 登录 -->
17         <custom-filter ref="loginAuthenticationFilter" position="FORM_LOGIN_FILTER" />
18 
19         <custom-filter ref="concurrencyFilter" position="CONCURRENT_SESSION_FILTER" />
20 
21         <custom-filter ref="mySecurityFilter" before="FILTER_SECURITY_INTERCEPTOR" />
22         <!-- 切换微信公众号 -->
23         <custom-filter ref="switchWxUserFilter" position="SWITCH_USER_FILTER" />
24 
25     </http>

详细可查spring官网csrf。。。

spring的form:form表单点击提交是，spring会为表单元素自动加上防伪标签，上传文件是相当于提交两次form表单，因此还需手动再加一次。