Webflux禁用特定URL上的CSRF

Posted 2023-02-24

想法是在webflux中复制http://blog.netgloo.com/2014/09/28/spring-boot-enable-the-csrf-check-selectively-only-for-some-requests/。

这是我到目前为止的地方：

@Configuration
@EnableWebFluxSecurity
@EnableReactiveMethodSecurity
public class SecurityConfig 

    @Bean
    SecurityWebFilterChain springSecurityFilterChain(final ServerHttpSecurity http) 
        http
           .csrf().requireCsrfProtectionMatcher(
                  new ServerWebExchangeMatcher() 

                    @Override
                    public Mono<MatchResult> matches(ServerWebExchange serverWebExchange) 
                    // here check if the url should have csrf or not and then return MatchResult.match() or notMatch(), however I find that if I return match then I get 'Invalid CSRF Token' error.
                    //    return MatchResult.match();
                    //    return MatchResult.notMatch();
                    
                
                ).and()
                .anyExchange().authenticated()
                .and()
                .httpBasic()
                .and()
                .formLogin().loginPage("/login")
                .and().logout()

        return http.build();
    

答案

这应该做到这一点

    @Bean
    SecurityWebFilterChain springSecurityFilterChain(final ServerHttpSecurity http) 
        http
           .csrf().requireCsrfProtectionMatcher(
                  new ServerWebExchangeMatcher() 

                    @Override
                    public Mono<MatchResult> matches(ServerWebExchange serverWebExchange) 
                        ServerWebExchangeMatchers.pathMatchers("/urls-with-csrf-check/**").matches(serverWebExchange)
                    
                
                ).and()
                .anyExchange().authenticated()
                .and()
                .httpBasic()
                .and()
                .formLogin().loginPage("/login")
                .and().logout()

        return http.build();
    

另一答案

config allowedOrigins：

@Bean
public WebFluxConfigurer corsConfigurer() 
    return new WebFluxConfigurerComposite() 

        @Override
        public void addCorsMappings(CorsRegistry registry) 
            registry
                .addMapping("/**")
                .allowedOrigins("/goodss")
                .allowedMethods("*");
        
    ;