如何从 Postman rest 客户端发送 spring csrf 令牌？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/27182701/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How do I send spring csrf token from Postman rest client?
提问by Surendra Jnawali
I have csrf protectionin spring framework. So in each request I send csrf token in header from ajax call, which is perfectly working.
我在 spring 框架中有csrf 保护。因此，在每个请求中，我都会在 ajax 调用的标头中发送 csrf 令牌，这非常有效。
<meta name="_csrf" content="${_csrf.token}"/>
<meta name="_csrf_header" content="${_csrf.headerName}"/>
var token = $("meta[name='_csrf']").attr("content");
var header = $("meta[name='_csrf_header']").attr("content");
In ajax
在阿贾克斯
beforeSend: function(xhr) {
xhr.setRequestHeader(header, token),
xhr.setRequestHeader("username", "xxxx1"),
xhr.setRequestHeader("password", "password")
}
I haven't any idea to generate csrf token and include in header section of Postman Rest Client? Would you please help me to send csrf token from Postman Rest Client?
我不知道生成 csrf 令牌并包含在 Postman Rest Client 的标题部分？你能帮我从 Postman Rest Client 发送 csrf 令牌吗？
采纳答案by johnny 5
The Easiest way to do this consistently so you don't have to get the token each time:
始终如一地执行此操作的最简单方法，因此您不必每次都获取令牌：
NOTE:you need to install PostMan Interceptor and activate it to have access to the browsers cookies
注意：您需要安装 PostMan Interceptor 并激活它才能访问浏览器 cookie
- Create a new environment so environment variables can be stored
- 创建一个新环境，以便可以存储环境变量
Create a login method with a test to store the XSRF cookie in an environment variable, in the test tab post this code
//Replace XSFR-TOKEN with your cookie name var xsrfCookie = postman.getResponseCookie("XSRF-TOKEN"); postman.setEnvironmentVariable("xsrf-token", xsrfCookie.value);
创建一个带有测试的登录方法，将 XSRF cookie 存储在环境变量中，在测试选项卡中发布此代码
//Replace XSFR-TOKEN with your cookie name var xsrfCookie = postman.getResponseCookie("XSRF-TOKEN"); postman.setEnvironmentVariable("xsrf-token", xsrfCookie.value);
EDITFor anyone using the 5.5.2 postman or later you will also have to decode the cookie, and they have also provided alternative ways to obtain cookies as @Sacapuces points out
编辑对于使用 5.5.2 邮递员或更高版本的任何人，您还必须解码 cookie，他们还提供了获取 cookie 的替代方法，正如@Sacapuces 指出的那样
pm.environment.set("xsrf-token", decodeURIComponent(pm.cookies.get("XSRF-TOKEN")))
Now you will have an environment variable with xsrf-token in it.
现在您将拥有一个带有 xsrf-token 的环境变量。
Save your login method
Create the new post you want to create and in the headers add your XSRF-Token-Header Key, and the environment variable in handle bars to access it{{}}
保存您的登录方法
创建您要创建的新帖子，并在标题中添加您的 XSRF-Token-Header 密钥和把手中的环境变量以访问它{{}}
- Now before running your new request make sure you run your login, it will store the environment variable, and then when you run the actually request it will automatically append it.
- 现在在运行您的新请求之前，请确保您运行您的登录名，它将存储环境变量，然后当您运行实际请求时，它会自动附加它。
回答by tranceholic
I am able to send REST with csrf token by following the steps below:
我可以按照以下步骤发送带有 csrf 令牌的 REST：
The CSRF token generated automatically by spring security when you logged in. It will be shown at the response header.
The CSRF token can be used on subsequent request by setting X-CSRF-TOKEN with CSRF token on header.
登录时由 spring security 自动生成的 CSRF 令牌。它将显示在响应头中。
通过在标头上设置带有 CSRF 令牌的 X-CSRF-TOKEN，可以在后续请求中使用 CSRF 令牌。
回答by Joel Neukom
Firstly you need to install PostMan Interceptor and activate it to have access to the browsers cookies.
首先，您需要安装 PostMan Interceptor 并激活它以访问浏览器 cookie。
You have to fetch the CSRF Token by making a GET Request: Header: "XSRF-TOKEN" and Value: "Fetch"
You should see the Token in the cookie tab and can copy it (Notice: You can configure spring how the cookie should be named. Maybe your cookie has another name than "XSRF-TOKEN". Attention: You have the remove this blank char in the token from the newline)
Now make your POST Request and set the header to: Header: "X-XSRF-TOKEN" and Value: "Your copied Token without blanks"
您必须通过发出 GET 请求来获取 CSRF 令牌：Header: "XSRF-TOKEN" 和 Value: "Fetch"
您应该在 cookie 选项卡中看到 Token 并可以复制它（注意：您可以配置 spring 应该如何命名 cookie。也许您的 cookie 有另一个名称而不是“XSRF-TOKEN”。注意：您已删除此空白字符来自换行符的令牌）
现在发出 POST 请求并将标题设置为： Header: "X-XSRF-TOKEN" 和 Value: "Your Copy Token without blanks"
回答by DmRomantsov
For me works variant with adding X-CSRF-TOKEN to headers.
对我来说，将 X-CSRF-TOKEN 添加到标头的工作变体。
回答by sofs1
If you don't want to configure environment variables etc. here is the quickest solution
如果您不想配置环境变量等，这里是最快的解决方案
回答by KPS250
Please put X-CSRF-Tokenas key and FETCHas the value in the GET request header and you will receive the token in the response header
请把X-CSRF-Token作为 key 和FETCH作为 GET 请求头中的值，您将在响应头中收到令牌
