spring security 4 csrf 通过 xml 禁用
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/31312844/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
spring security 4 csrf disable via xml
提问by Priyanka Lopes
Is there a way to disable CSRF token in spring security via XML configuration? I see only java configuration online..can xml based examples. Using spring framework 4.0
有没有办法通过 XML 配置在 Spring Security 中禁用 CSRF 令牌？我只在网上看到 java 配置..可以基于 xml 的例子。使用 spring 框架 4.0
回答by Priyanka Lopes
As of Spring Security 4.0, CSRF protection is enabled by default with XML configuration. If you would like to disable CSRF protection, the corresponding XML configuration can be seen below.
<http> <!-- ... --> <csrf disabled="true"/> </http>CSRF protection is enabled by default with Java configuration. If you would like to disable CSRF, the corresponding Java configuration can be seen below. Refer to the Javadoc of csrf() for additional customizations in how CSRF protection is configured.
@EnableWebSecurity public class WebSecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http .csrf().disable(); } }
从 Spring Security 4.0 开始，默认情况下使用 XML 配置启用 CSRF 保护。如果您想禁用 CSRF 保护，可以在下面看到相应的 XML 配置。
<http> <!-- ... --> <csrf disabled="true"/> </http>使用 Java 配置默认启用 CSRF 保护。如果您想禁用 CSRF，可以在下面看到相应的 Java 配置。有关如何配置 CSRF 保护的其他自定义，请参阅 csrf() 的 Javadoc。
@EnableWebSecurity public class WebSecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http .csrf().disable(); } }
See below link http://docs.spring.io/spring-security/site/docs/4.0.x/reference/htmlsingle/#csrf-configure
请参阅以下链接 http://docs.spring.io/spring-security/site/docs/4.0.x/reference/htmlsingle/#csrf-configure
回答by Victor Ionescu
In your context.xml, assuming you have the xsd declaration for security:
在您的 context.xml 中，假设您有安全性的 xsd 声明：
xmlns:security="http://www.springframework.org/schema/security",
Inside the <security:http>element add
在<security:http>元素内添加
<security:csrf disabled="true"/>
回答by csharpfolk
For total beginners, if you are following Spring MVC beginners guide book then in security-context.xmlfile add csrf disabled="true"line:
对于初学者，如果您正在遵循 Spring MVC 初学者指南，那么在security-context.xml文件中添加csrf disabled="true"行：
<security:http auto-config="true">
<security:intercept-url pattern="/products/add"
access="ROLE_ADMIN" />
<security:form-login login-page="/login"
default-target-url="/products/add"
authentication-failure-url="/loginfailed" />
<security:logout logout-success-url="/logout" />
<security:csrf disabled="true" />
</security:http>
