防止 Java 中的跨站请求伪造 (CSRF) 攻击
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/23152178/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
prevent Cross-Site Request Forgery (CSRF) Attack in Java
提问by Suniel
Here is a sample of my web application. Does it vulnerable to Cross-Site Request Forgery (CSRF) Attack? How can i prevent from CSRF?
这是我的 Web 应用程序的示例。它是否容易受到跨站请求伪造 (CSRF) 攻击？如何防止CSRF？
here is my new.jsp for adding new user.
这是我用于添加新用户的 new.jsp。
<FORM NAME="Form" METHOD="post" ACTION="controller?event=PostNewUser">
<TABLE WIDTH="655" BORDER="0" CELLPADDING="2" CELLSPACING="0" class="gray_background" align="center" >
<TR><TD colspan="4" CLASS="text" align="left"><strong>Personal Details</strong></TD></TR>
<tr>
<td colspan="4">
<table >
<TR>
<TD width="62" align="right" CLASS="text">Code : </td>
<td width="144"><INPUT NAME="code" TYPE="text" id="code" VALUE="N" CLASS="password" maxlength="9"></td>
<td width="66" align="right" CLASS="text">Name : </td>
<TD width="144" align="left" CLASS="text"><input name="name" type="text" id="name" value="" class="password" maxlength="80">
</TD>
<TD width="44" align="right" CLASS="text">Email : </TD>
<TD width="152" align="left" CLASS="text"><input name="email" type="text" id="email" value="" class="password" maxlength="70"></TD>
</TR>
<TR>
<TD colspan="4" CLASS="text" align="center"><INPUT NAME="submit" TYPE="submit" class="submit_button" VALUE="Create" ></TD>
</TR>
</TABLE>
</FORM>
And here is my servlet.
这是我的 servlet。
public class PostNewAgentEventHandler extends EventHandlerBase {
protected void process(HttpServletRequest request,
HttpServletResponse response) throws Exception {
String name = request.getParameter("name").trim();
String agentCode = request.getParameter("code").trim();
String email = request.getParameter("email").trim();
}
}
采纳答案by Martin Ellis
You might consider using OWASP CSRFGuard. It's a Filter for servlet applications designed to prevent CSRF attacks.
您可能会考虑使用OWASP CSRFGuard。它是用于 servlet 应用程序的过滤器，旨在防止 CSRF 攻击。
Their web site design isn't brilliant. You can find the Installation Guide, User Manualand other links by scrolling down to the bottom of the page.
