防止Java中的跨站请求伪造(CSRF)攻击

Question

这是我的Web应用程序示例.它是否容易受到跨站点请求伪造(CSRF)攻击？我怎样才能阻止CSRF？

这是我的new.jsp用于添加新用户.

            <FORM NAME="Form" METHOD="post" ACTION="controller?event=PostNewUser">
                <TABLE WIDTH="655" BORDER="0" CELLPADDING="2" CELLSPACING="0" class="gray_background" align="center" >        
                    <TR><TD colspan="4" CLASS="text" align="left"><strong>Personal Details</strong></TD></TR>
                    <tr>
                        <td colspan="4">
                            <table >
                                <TR>
                                    <TD width="62" align="right" CLASS="text">Code :&nbsp;</td>
                                    <td width="144"><INPUT NAME="code" TYPE="text" id="code" VALUE="N" CLASS="password" maxlength="9"></td>
                                    <td width="66" align="right" CLASS="text">Name :&nbsp; </td>
                                    <TD width="144" align="left" CLASS="text"><input name="name" type="text" id="name" value="" class="password" maxlength="80">
                                    </TD>
                                    <TD width="44" align="right" CLASS="text">Email :&nbsp;</TD>
                                    <TD width="152" align="left" CLASS="text"><input name="email" type="text" id="email" value="" class="password" maxlength="70"></TD>
                                </TR>                       
                    <TR>
                        <TD colspan="4" CLASS="text" align="center"><INPUT NAME="submit" TYPE="submit" class="submit_button" VALUE="Create" ></TD>
                    </TR>        
                </TABLE>
            </FORM>

这是我的servlet.

 public class PostNewAgentEventHandler extends EventHandlerBase {

 protected void process(HttpServletRequest request,
        HttpServletResponse response) throws Exception {

 String name = request.getParameter("name").trim();
 String agentCode = request.getParameter("code").trim();
 String email = request.getParameter("email").trim();
}
}

Answer 1

您可以考虑使用OWASP CSRFGuard.它是用于防止CSRF攻击的servlet应用程序的过滤器.

他们的网站设计并不精彩.您可以通过向下滚动到页面底部找到" 安装指南"," 用户手册"和其他链接.