SEC-1574: Add CSRF Support
This commit is contained in:
Rob Winch
@@ -89,6 +89,14 @@ The <<security-config-java,`SecurityConfig`>> will:
|
||||
* Allow the user with the *Username* _user_ and the *Password* _password_ to authenticate with form based authentication
|
||||
* Allow the user with the *Username* _user_ and the *Password* _password_ to authenticate with HTTP basic authentication
|
||||
* Allow the user to logout
|
||||
* http://en.wikipedia.org/wiki/Cross-site_request_forgery[CSRF attack] prevention
|
||||
* http://en.wikipedia.org/wiki/Session_fixation[Session Fixation] protection
|
||||
* Security Header integration
|
||||
** http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security[HTTP Strict Transport Security] for secure requests
|
||||
** http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx[X-Content-Type-Options] integration
|
||||
** Cache Control (can be overridden later by your application to allow caching of your static resources)
|
||||
** http://msdn.microsoft.com/en-us/library/dd565647(v=vs.85).aspx[X-XSS-Protection] integration
|
||||
** X-Frame-Options integration to help prevent http://en.wikipedia.org/wiki/Clickjacking[Clickjacking]
|
||||
* Integrate with the following Servlet API methods
|
||||
** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#getRemoteUser()[HttpServletRequest#getRemoteUser()]
|
||||
** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#getUserPrincipal()[HttpServletRequest.html#getUserPrincipal()]
|
||||
|
||||
@@ -112,10 +112,12 @@ Now that we can view the user name, let's update the application to allow loggin
|
||||
[subs="verbatim,quotes"]
|
||||
----
|
||||
<div class="nav-collapse collapse">
|
||||
*<c:url var="logoutUrl" value="/logout"/>
|
||||
<form:form class="navbar-form pull-right" action="${logoutUrl}" method="post">
|
||||
<input type="submit" value="Log out" />
|
||||
</form:form>*
|
||||
<p class="navbar-text pull-right">
|
||||
<c:out value="${pageContext.request.remoteUser}"/>
|
||||
*<c:url var="logoutUrl" value="/logout"/>
|
||||
<a href="${logoutUrl}">Log out</a>*
|
||||
</p>
|
||||
<ul class="nav">
|
||||
<c:url var="inboxUrl" value="/"/>
|
||||
@@ -125,8 +127,12 @@ Now that we can view the user name, let's update the application to allow loggin
|
||||
</ul>
|
||||
</div>
|
||||
----
|
||||
In order to help protect against http://en.wikipedia.org/wiki/Cross-site_request_forgery[CSRF attacks], by default, Spring Security Java Configuration log out requires:
|
||||
|
||||
Refresh the page at http://localhost:8080/sample/ and you will see the log out link. Click the link and see that the application logs you out successfully.
|
||||
* the HTTP method must be a POST
|
||||
* the CSRF token must be added to the request. Since we are using Spring MVC, the CSRF token is automatically added as a hidden input for you (view the source to see it). If you were not using Spring MVC, you can access the CsrfToken on the ServletRequest using the attribute _csrf
|
||||
|
||||
Refresh the page at http://localhost:8080/sample/ and you will see the log out button. Click the button and see that the application logs you out successfully.
|
||||
|
||||
include::hello-includes/basic-authentication.asc[]
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
= Hello Spring Security Java Config
|
||||
:author: Rob Winch
|
||||
:starter-appname: insecure
|
||||
:starter-appname: insecure
|
||||
:completed-appname: helloworld-jc
|
||||
:verify-starter-app-include: hello-includes/verify-insecure-app.asc
|
||||
|
||||
@@ -77,18 +77,24 @@ Now that we can view the user name, let's update the application to allow loggin
|
||||
<body>
|
||||
<div class="container">
|
||||
<h1>This is secured!</h1>
|
||||
<p>
|
||||
Hello <b><c:out value="${pageContext.request.remoteUser}"/></b>
|
||||
</p>
|
||||
<c:url var="logoutUrl" value="/logout"/>
|
||||
<p>
|
||||
Hello <b><c:out value="${pageContext.request.remoteUser}"/></b>
|
||||
</p>
|
||||
<p>
|
||||
<a href="${logoutUrl}">Click here</a> to log out.
|
||||
</p>
|
||||
<form class="form-inline" action="${logoutUrl}" method="post">
|
||||
<input type="submit" value="Log out" />
|
||||
<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
|
||||
</form>
|
||||
</div>
|
||||
</body>
|
||||
----
|
||||
|
||||
Refresh the page at http://localhost:8080/sample/ and you will see the log out link. Click the link and see that the application logs you out successfully.
|
||||
In order to help protect against http://en.wikipedia.org/wiki/Cross-site_request_forgery[CSRF attacks], by default, Spring Security Java Configuration log out requires:
|
||||
|
||||
* the HTTP method must be a POST
|
||||
* the CSRF token must be added to the request You can access it on the ServletRequest using the attribute _csrf as illustrated above. If you were using Spring MVC, the CSRF token is automatically added as a hidden input for you.
|
||||
|
||||
Refresh the page at http://localhost:8080/sample/ and you will see the log out button. Click the logout button and see that the application logs you out successfully.
|
||||
|
||||
include::hello-includes/basic-authentication.asc[]
|
||||
|
||||
|
||||
@@ -211,6 +211,7 @@
|
||||
<itemizedlist>
|
||||
<listitem><link xlink:href="#nsa-access-denied-handler">access-denied-handler</link></listitem>
|
||||
<listitem><link xlink:href="#nsa-anonymous">anonymous</link></listitem>
|
||||
<listitem><link xlink:href="#nsa-csrf">csrf</link></listitem>
|
||||
<listitem><link xlink:href="#nsa-custom-filter">custom-filter</link></listitem>
|
||||
<listitem><link xlink:href="#nsa-expression-handler">expression-handler</link></listitem>
|
||||
<listitem><link xlink:href="#nsa-form-login">form-login</link></listitem>
|
||||
@@ -518,6 +519,30 @@
|
||||
</section>
|
||||
</section>
|
||||
</section>
|
||||
<section xml:id="nsa-csrf">
|
||||
<title><literal><csrf></literal></title>
|
||||
<para>This element will add <a href="">CSRF</a> to the application. It also updates the default RequestCache
|
||||
to only replay "GET" requests upon successful authentication.</para>
|
||||
<section xml:id="nsa-csrf-parents">
|
||||
<title>Parent Elements of <literal><csrf></literal></title>
|
||||
<itemizedlist>
|
||||
<listitem><link xlink:href="#nsa-http">http</link></listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
<section xml:id="nsa-csrf-attributes">
|
||||
<title><literal><csrf></literal> Attributes</title>
|
||||
<section xml:id="nsa-csrf-token-repository-ref">
|
||||
<title><literal>token-repository-ref</literal></title>
|
||||
<para>The CsrfTokenRepository to use. The default is
|
||||
<classname>HttpSessionCsrfTokenRepository</classname>.</para>
|
||||
</section>
|
||||
<section xml:id="nsa-csrf-request-matcher-ref">
|
||||
<title><literal>request-matcher-ref</literal></title>
|
||||
<para>The RequestMatcher instance to be used to determine if CSRF should be applied. Default is any
|
||||
HTTP method except "GET", "TRACE", "HEAD", "OPTIONS".</para>
|
||||
</section>
|
||||
</section>
|
||||
</section>
|
||||
<section xml:id="nsa-custom-filter">
|
||||
<title><literal><custom-filter></literal></title>
|
||||
<para>This element is used to add a filter to the filter chain. It doesn't create any
|
||||
|
||||
@@ -716,9 +716,14 @@ List<OpenIDAttribute> attributes = token.getAttributes();</programlisting>The
|
||||
</row>
|
||||
<row>
|
||||
<entry>HEADERS_FILTER</entry>
|
||||
<entry><literal>HeadersFilter</literal> </entry>
|
||||
<entry><literal>HeaderWriterFilter</literal> </entry>
|
||||
<entry><literal>http/headers</literal></entry>
|
||||
</row>
|
||||
<row>
|
||||
<entry>CSRF_FILTER</entry>
|
||||
<entry><literal>CsrfFilter</literal> </entry>
|
||||
<entry><literal>http/csrf</literal></entry>
|
||||
</row>
|
||||
<row>
|
||||
<entry> LOGOUT_FILTER </entry>
|
||||
<entry><literal>LogoutFilter</literal></entry>
|
||||
|
||||
Reference in New Issue
Block a user