使用从GET请求接收的CSRF令牌在Java中进行POST-403-禁止-CSRF令牌验证错误

时间:2019-02-05 11:14:05

标签: validation post token csrf

CSRF令牌验证失败-403错误-禁止 我没有发现它失败的任何原因。

-提供正确的CSRF令牌值 -还提供了Cookie

    static OkHttpClient client = new OkHttpClient();

    public void run() throws IOException {
    String[] headCookie = MyGETRequest();
    POSTRequest(headCookie);        
}

public static String[] MyGETRequest() throws IOException {
    Request request = new Request.Builder()
      .url("GET URL")
      .get()
      .addHeader("x-csrf-token", "FETCH")
      .addHeader("authorization", "BASICAuthentication string")
      .build();

    Response response = client.newCall(request).execute();
    String ar[] = new String[2];
    ar[0] = response.headers().get("set-cookie");
    ar[1] = response.headers().get("x-csrf-token");
    response.close();
    return ar;
}

public void POSTRequest(String[] headerCookie) throws IOException {
    MediaType mediaType = MediaType.parse("application/json");
    RequestBody body = RequestBody.create(mediaType,"POST BODY");
    Request request = new Request.Builder()
      .url("POST URL")
      .post(body)
      .addHeader("set-cookie", headerCookie[0])
      .addHeader("x-csrf-token", headerCookie[1])
      .addHeader("authorization", "BASICAuthentication string - same as GET")
      .addHeader("accept", "application/json")
      .addHeader("content-type", "application/json")
      .build();

    Response response = client.newCall(request).execute();
    response.close();   
}

POST应该成功。我搜索了各个论坛,所有论坛都以类似的方式进行POST

0 个答案:

没有答案