spring security 跨域防伪攻击

applicationContext-security.xml中配置

<http use-expressions="true" disable-url-rewriting="false" entry-point-ref="loginUrlAuthenticationEntryPoint">
        <!-- <intercept-url pattern="/resources/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/> -->
        <intercept-url pattern="/login" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <intercept-url pattern="/logincheck" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <intercept-url pattern="/error/accessdenied*" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <!-- <intercept-url pattern="/messagecode/getimagecode*" access="IS_AUTHENTICATED_ANONYMOUSLY"/> -->
 7         <!-- 跨站请求伪造 -->
 8         <csrf />
        <access-denied-handler ref="accessDeniedHandler"/>

        <intercept-url pattern="/**" access="isAuthenticated()" />

        <session-management session-authentication-strategy-ref="sas" />
        <!-- 登出 -->
        <logout invalidate-session="true" logout-success-url="/login" logout-url="/logout" />
        <!-- 登录 -->
        <custom-filter ref="loginAuthenticationFilter" position="FORM_LOGIN_FILTER" />

        <custom-filter ref="concurrencyFilter" position="CONCURRENT_SESSION_FILTER" />

        <custom-filter ref="mySecurityFilter" before="FILTER_SECURITY_INTERCEPTOR" />
        <!-- 切换微信公众号 -->
        <custom-filter ref="switchWxUserFilter" position="SWITCH_USER_FILTER" />

    </http>

详细可查spring官网csrf。。。

spring的form:form表单点击提交是，spring会为表单元素自动加上防伪标签，上传文件是相当于提交两次form表单，因此还需手动再加一次。