Question

我已经建立了一个基于struts的简单项目。尝试将CSRFGuard实施到其中。

以下是csrfguard.properties文件：

org.owasp.csrfguard.Logger=org.owasp.csrfguard.log.JavaLogger
org.owasp.csrfguard.configuration.provider.factory = org.owasp.csrfguard.config.overlay.ConfigurationAutodetectProviderFactory
org.owasp.csrfguard.Enabled = true
org.owasp.csrfguard.ValidateWhenNoSessionExists = false
org.owasp.csrfguard.NewTokenLandingPage=%servletContext%/Login.do
org.owasp.csrfguard.TokenPerPage=true
org.owasp.csrfguard.TokenPerPagePrecreate=false
org.owasp.csrfguard.Rotate=true
org.owasp.csrfguard.Ajax=true
org.owasp.csrfguard.unprotected.Default=%servletContext%/
org.owasp.csrfguard.unprotected.JavaScriptServlet=%servletContext%/JavaScriptServlet
org.owasp.csrfguard.unprotected.Error=%servletContext%/error_page.jsp
org.owasp.csrfguard.unprotected.Index=%servletContext%/index.jsp
org.owasp.csrfguard.unprotected.Scripts=%servletContext%/scripts/*
org.owasp.csrfguard.unprotected.Styles=%servletContext%/styles/*
org.owasp.csrfguard.unprotected.Images=%servletContext%/images/*
org.owasp.csrfguard.action.Log=org.owasp.csrfguard.action.Log
org.owasp.csrfguard.action.Log.Message=potential cross-site request forgery (CSRF) attack thwarted (user:%user%, ip:%remote_ip%, method:%request_method%, uri:%request_uri%, error:%exception_message%)
org.owasp.csrfguard.action.Redirect=org.owasp.csrfguard.action.Redirect
org.owasp.csrfguard.action.Redirect.Page=%servletContext%/error_page.jsp
org.owasp.csrfguard.action.Rotate=org.owasp.csrfguard.action.Rotate
org.owasp.csrfguard.TokenName=csrfToken
org.owasp.csrfguard.SessionKey=csrfToken
org.owasp.csrfguard.TokenLength=32
org.owasp.csrfguard.PRNG=SHA1PRNG
org.owasp.csrfguard.PRNG.Provider=SUN
org.owasp.csrfguard.Config.Print = true
org.owasp.csrfguard.JavascriptServlet.sourceFile =  WEB-INF/conf/csrfguard.js
org.owasp.csrfguard.JavascriptServlet.domainStrict = true
org.owasp.csrfguard.JavascriptServlet.cacheControl = private, maxage=28800
org.owasp.csrfguard.JavascriptServlet.refererPattern = .*
org.owasp.csrfguard.JavascriptServlet.refererMatchDomain = true
org.owasp.csrfguard.JavascriptServlet.injectIntoForms = true
org.owasp.csrfguard.JavascriptServlet.injectGetForms = true
org.owasp.csrfguard.JavascriptServlet.injectFormAttributes = true
org.owasp.csrfguard.JavascriptServlet.injectIntoAttributes = true 
org.owasp.csrfguard.JavascriptServlet.xRequestedWith = OWASP CSRFGuard Project
org.owasp.csrfguard.configOverlay.hierarchy = classpath:Owasp.CsrfGuard.properties, classpath:Owasp.CsrfGuard.overlay.properties
org.owasp.csrfguard.configOverlay.secondsBetweenUpdateChecks = 60

以下是我的web.xml的片段

    <context-param>
        <param-name>Owasp.CsrfGuard.Config</param-name>
        <param-value>WEB-INF/conf/csrfguard.properties</param-value>
    </context-param>
    <context-param>
        <param-name>Owasp.CsrfGuard.Config.Print</param-name>
        <param-value>true</param-value>
    </context-param>
    <listener>
        <listener-class>org.owasp.csrfguard.CsrfGuardServletContextListener</listener-class>
    </listener>
    <listener>
        <listener-class>org.owasp.csrfguard.CsrfGuardHttpSessionListener</listener-class>
    </listener>
    <filter>
        <filter-name>CSRFGuard</filter-name>
        <filter-class>org.owasp.csrfguard.CsrfGuardFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>CSRFGuard</filter-name> 
        <url-pattern>/*</url-pattern>
    </filter-mapping>

当我启动应用程序并提供其URL时，它会正确加载登录页面。这是一个没有保护的页面。接下来当我点击登录时，它会处理请求。当我调试代码时，我可以看到tokenFromPages和tokenFromSession具有值。但是变量tokenFromRequest以null形式出现。并且因为它将变为null，所以它会丢弃请求中缺少的所需令牌＆＃34;例外。文件：CsrfGuard.java 方法：verifyPageToken 抛出异常的条件：

if (tokenFromRequest == null) {
    /** FAIL: token is missing from the request **/
    throw new CsrfGuardException("required token is missing from the request");
}

是的，请有人帮助我。如果您还需要更多信息，请与我们联系。

添加日志以显示问题：

URL: http://localhost:8080/App1/Login.do?csrfToken=GQQD-MEJT

我点击了登录页面，下面是生成的日志。我不知道为什么它为tokenFromRequest显示null。

Aug 29, 2014 8:33:03 PM org.owasp.csrfguard.log.JavaLogger log
INFO: CsrfGuard analyzing request /App1/Login.do
tokenFromPages --> N92E-COOR
tokenFromSession --> KLGU-DDRZ
tokenFromRequest --> null
Aug 29, 2014 8:33:03 PM org.owasp.csrfguard.log.JavaLogger log
WARNING: potential cross-site request forgery (CSRF) attack thwarted (user:<anonymous>, ip:127.0.0.1, method:POST, uri:/App1/Login.do, error:required token is missing from the request)
Aug 29, 2014 8:33:03 PM org.owasp.csrfguard.log.JavaLogger log
INFO: CsrfGuard analyzing request /App1/error_page.jsp
Aug 29, 2014 8:33:03 PM org.owasp.csrfguard.log.JavaLogger log
INFO: CsrfGuard analyzing request /App1/Login.do
tokenFromPages --> GQQD-MEJT
tokenFromSession --> CD7O-C556
tokenFromRequest --> GQQD-MEJT

Answer 1

请尝试将NewTokenLandingPage属性留空。

修改/注释
org.owasp.csrfguard.NewTokenLandingPage =％参数servletContext％/ Login.do

到

org.owasp.csrfguard.NewTokenLandingPage =

我还建议一步一步来。不要在第一次启用页面令牌和令牌轮换。旋转和页面标记可能会引入许多问题。首先让它使用会话令牌，然后逐步启用功能。

CSRFGuard：请求中缺少必需的令牌

1 个答案: