Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1574: Add CSRF Support

Browse Source
This commit is contained in:
Rob Winch
2013-08-15 14:49:21 -05:00
parent 5f35d9e3ec
commit e9bb9e766e
93 changed files with 2895 additions and 348 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
docs/guides/src/asciidoc/hello-includes/secure-the-application.asc
View File

@@ -89,6 +89,14 @@ The <<security-config-java,`SecurityConfig`>> will:
* Allow the user with the *Username* _user_ and the *Password* _password_ to authenticate with form based authentication
* Allow the user with the *Username* _user_ and the *Password* _password_ to authenticate with HTTP basic authentication
* Allow the user to logout
* http://en.wikipedia.org/wiki/Cross-site_request_forgery[CSRF attack] prevention
* http://en.wikipedia.org/wiki/Session_fixation[Session Fixation] protection
* Security Header integration
** http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security[HTTP Strict Transport Security] for secure requests
** http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx[X-Content-Type-Options] integration
** Cache Control (can be overridden later by your application to allow caching of your static resources)
** http://msdn.microsoft.com/en-us/library/dd565647(v=vs.85).aspx[X-XSS-Protection] integration
** X-Frame-Options integration to help prevent http://en.wikipedia.org/wiki/Clickjacking[Clickjacking]
* Integrate with the following Servlet API methods
** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#getRemoteUser()[HttpServletRequest#getRemoteUser()]
** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#getUserPrincipal()[HttpServletRequest.html#getUserPrincipal()]

12
docs/guides/src/asciidoc/hellomvc.asc
View File

@@ -112,10 +112,12 @@ Now that we can view the user name, let's update the application to allow loggin
[subs="verbatim,quotes"]
----
<div class="nav-collapse collapse">
*<c:url var="logoutUrl" value="/logout"/>
<form:form class="navbar-form pull-right" action="${logoutUrl}" method="post">
<input type="submit" value="Log out" />
</form:form>*
<p class="navbar-text pull-right">
<c:out value="${pageContext.request.remoteUser}"/>
*<c:url var="logoutUrl" value="/logout"/>
<a href="${logoutUrl}">Log out</a>*
</p>
<ul class="nav">
<c:url var="inboxUrl" value="/"/>
@@ -125,8 +127,12 @@ Now that we can view the user name, let's update the application to allow loggin
</ul>
</div>
----
In order to help protect against http://en.wikipedia.org/wiki/Cross-site_request_forgery[CSRF attacks], by default, Spring Security Java Configuration log out requires:
Refresh the page at http://localhost:8080/sample/ and you will see the log out link. Click the link and see that the application logs you out successfully.
* the HTTP method must be a POST
* the CSRF token must be added to the request. Since we are using Spring MVC, the CSRF token is automatically added as a hidden input for you (view the source to see it). If you were not using Spring MVC, you can access the CsrfToken on the ServletRequest using the attribute _csrf
Refresh the page at http://localhost:8080/sample/ and you will see the log out button. Click the button and see that the application logs you out successfully.
include::hello-includes/basic-authentication.asc[]

22
docs/guides/src/asciidoc/helloworld.asc
View File

@@ -1,6 +1,6 @@
= Hello Spring Security Java Config
:author: Rob Winch
:starter-appname: insecure
:starter-appname: insecure
:completed-appname: helloworld-jc
:verify-starter-app-include: hello-includes/verify-insecure-app.asc
@@ -77,18 +77,24 @@ Now that we can view the user name, let's update the application to allow loggin
<body>
<div class="container">
<h1>This is secured!</h1>
<p>
Hello <b><c:out value="${pageContext.request.remoteUser}"/></b>
</p>
<c:url var="logoutUrl" value="/logout"/>
<p>
Hello <b><c:out value="${pageContext.request.remoteUser}"/></b>
</p>
<p>
<a href="${logoutUrl}">Click here</a> to log out.
</p>
<form class="form-inline" action="${logoutUrl}" method="post">
<input type="submit" value="Log out" />
<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
</form>
</div>
</body>
----
Refresh the page at http://localhost:8080/sample/ and you will see the log out link. Click the link and see that the application logs you out successfully.
In order to help protect against http://en.wikipedia.org/wiki/Cross-site_request_forgery[CSRF attacks], by default, Spring Security Java Configuration log out requires:
* the HTTP method must be a POST
* the CSRF token must be added to the request You can access it on the ServletRequest using the attribute _csrf as illustrated above. If you were using Spring MVC, the CSRF token is automatically added as a hidden input for you.
Refresh the page at http://localhost:8080/sample/ and you will see the log out button. Click the logout button and see that the application logs you out successfully.
include::hello-includes/basic-authentication.asc[]