Question

我在Zuul后面运行一个Oauth2服务器。 Zuul将用户转发到登录页面。 Zuul还定义了以下HttpSecurity：

@Override
public void configure(HttpSecurity http) throws Exception {
...
.and().csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
}

Oauth2服务器上的登录Freemarker模板解析CSRF令牌，如下所示：

<from>
...
 <input type="hidden" id="csrf_token" name="${_csrf.parameterName}" value="${_csrf.token}"/>
</form>

直到这里，一切正常。不，我包含密码重置Freemarker模板的链接：

<a href="/uaa/reset"><@spring.message "login.forgot"/></a>

以及以下WebMvcConfigurerAdapter配置：

@Configuration
public class OAuthWebFormConfiguration extends WebMvcConfigurerAdapter {

@Override
public void addViewControllers(ViewControllerRegistry registry) {
    registry.addViewController("/login").setViewName("login");
    registry.addViewController("/reset").setViewName("reset");
}

当我导航到重置视图时，出现以下错误：

 : Servlet.service() for servlet [dispatcherServlet] in context with path 
 [/uaa] threw exception [Request processing failed; nested exception is 
 freemarker.core.InvalidReferenceException: The following has evaluated to 
 null or missing:
 ==> _csrf  [in template "reset.ftl" at line 21, column 64]

 Tip: If the failing expression is known to legally refer to something 
 that's sometimes null or missing, either specify a default value like 
 myOptionalVar!myDefault, or use <#if myOptionalVar??>when-
 present<#else>when-missing</#if>. (These only cover the last step of the 
 expression; to cover the whole expression, use parenthesis: 
 (myOptionalVar.foo)!myDefault, (myOptionalVar.foo)??

 FTL stack trace ("~" means nesting-related):
- Failed at: ${_csrf.parameterName}  [in template "reset.ftl" at line 21, 
column 62]
----] with root cause

freemarker.core.InvalidReferenceException: The following has evaluated to 
null or missing:
==> _csrf  [in template "reset.ftl" at line 21, column 64]

Tip: If the failing expression is known to legally refer to something that's 
sometimes null or missing, either specify a default value like 
myOptionalVar!myDefault, or use <#if myOptionalVar??>when-
present<#else>when-
missing</#if>. (These only cover the last step of the expression; to cover 
the whole expression, use parenthesis: (myOptionalVar.foo)!myDefault, 
(myOptionalVar.foo)??

FTL stack trace ("~" means nesting-related):
- Failed at: ${_csrf.parameterName}  [in template "reset.ftl" at line 21, 
column 62]

任何帮助？

Answer 1

修复方法是将重置视图添加到antMatchers列表中，如下所示：

CsrfFilter

这样弹簧func tableView(_ tableView: UITableView, didSelectRowAt indexPath: IndexPath) { let storyboard = UIStoryboard(name: "Main", bundle: nil) let modalView = storyboard.instantiateViewController(withIdentifier: "ModalView") self.present(modalView, animated: true) { tableView.deselectRow(at: indexPath, animated: false) } }将启动，并将CSRF令牌添加为请求属性。

Freemarker模板中的Spring CSRF令牌为null

1 个答案: