休息模板错误403

Question

我正在尝试实现一个请求方法，但我不知道如何将 X-XSRF-TOKEN 发送到我的网络服务。

在webservice中，token配置为X-XSRF-TOKEN

<beans:bean id="csrfTokenRepository"
    class="org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository">
    <beans:property name="headerName" value="X-XSRF-TOKEN" />
</beans:bean>

我的 android 应用程序中有它

public class WSConfig {
private static String urlBase = "http://192.168.25.226:8080/webapi/";
private static HttpHeaders httpHeaders;
private static RestTemplate restTemplate = new RestTemplate();
private static HttpEntity<String> httpEntity = new HttpEntity(getXSRF());
private static ResponseEntity<String> response;

public static HttpHeaders getXSRF() {
    try {
    HttpEntity<String> responseEntity = restTemplate.exchange(urlBase, HttpMethod.GET, null, String.class);
    CookieManager cookieManager = new CookieManager();
    List<String> cookieHeader = responseEntity.getHeaders().get("Set-Cookie");
    httpHeaders = new HttpHeaders();
    httpHeaders.setAccept(Arrays.asList(MediaType.APPLICATION_JSON));

    if (cookieHeader != null) {
        for (String cookie : cookieHeader) {
            String[] tokens = TextUtils.split(cookie, "=");
            if (tokens[0].equals("XSRF-TOKEN")) {
                String[] tokenValue = TextUtils.split(tokens[1],";");
                httpHeaders.add("X-XSRF-TOKEN", tokenValue[0]);
            }
            if (tokens[0].equals("JSESSIONID")) {
                String[] tokenValue = TextUtils.split(tokens[1],";");
                httpHeaders.add("Cookie", "JSSESSIONID="+tokenValue[0]);
            }
        }
    }
    } finally {
        return httpHeaders;
    }
}

public static HttpEntity<String> makeRequest(String uri, HttpMethod method) {
    try {
        restTemplate.setErrorHandler(new DefaultResponseErrorHandler(){
            protected boolean hasError(HttpStatus statusCode) {
                return false;
            }});

        System.out.println(httpEntity.getHeaders());
        response = restTemplate.exchange(urlBase + "registrar", HttpMethod.POST, null, String.class);
        System.out.println(response.getHeaders());
        System.out.println(response.getBody());
    } catch (HttpStatusCodeException e) {
        e.printStackTrace();
    }
    return null;
}
}

在我的 LogCat 中，我从 System.outs

中获得了这些结果

System.out.println(httpEntity.getHeaders());
{Accept=[application/json], Cookie=[JSSESSIONID=D0D537D4C38D2D69B01BF4F98B540763], X-XSRF-TOKEN=[8c21c671-bba4-4624-ada1-ff1e9e8f2e22]}

System.out.println(response.getHeaders());
{Server=[Apache-Coyote/1.1], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-XSS-Protection=[1; mode=block], X-Frame-Options=[DENY], X-Content-Type-Options=[nosniff], Set-Cookie=[JSESSIONID=7DBA84F6218BC9A8328A97587FC6293A; Path=/webapi/; HttpOnly], Content-Type=[text/html;charset=utf-8], Content-Language=[en], Content-Length=[1073], Date=[Thu, 20 Aug 2015 00:53:46 GMT], X-Android-Sent-Millis=[1440032027763], X-Android-Received-Millis=[1440032027805], X-Android-Response-Source=[NETWORK 403]}

而且，错误

System.out.println(response.getBody());
HTTP Status 403 - Expected CSRF token not found. Has your session expired?

我不知道我必须做什么，我正在正确发送 header，但无法发送 post。

已更新

我认为这个错误与 JSESSIONID 有关，而不是 XSRF-TOKEN，在我第一次 GET（获取 XSRF）后的某个时间，session 即将过期。

Answer 1

解决方案

正如我所说，这个错误与JSESSIONID有关。

当我拆分 JSESSIONID cookie 时，它丢失了使 cookie 存活所需的东西（可能是路径？）

所以，不要像这样添加 cookie

httpHeaders.add("Cookie", "JSSESSIONID="+tokenValue[0]);

我是这样附上的

httpHeaders.add("Cookie", cookie);

制作，我确保所有内容都附加到新的header。

最后的方法。

public static HttpHeaders getXSRF() {
    try {
    HttpEntity<String> responseEntity = restTemplate.exchange(urlBase, HttpMethod.GET, null, String.class);
    CookieManager cookieManager = new CookieManager();
    List<String> cookieHeader = responseEntity.getHeaders().get("Set-Cookie");
    httpHeaders = new HttpHeaders();
    httpHeaders.setAccept(Arrays.asList(MediaType.APPLICATION_JSON));

    if (cookieHeader != null) {
        for (String cookie : cookieHeader) {
            String[] tokens = TextUtils.split(cookie, "=");
            if (tokens[0].equals("XSRF-TOKEN")) {
                String[] tokenValue = TextUtils.split(tokens[1],";");
                httpHeaders.add("X-XSRF-TOKEN", tokenValue[0]);
            }
            if (tokens[0].equals("JSESSIONID"))
                httpHeaders.add("Cookie", cookie);
        }
    }
    } finally {
        return httpHeaders;
    }
}

休息模板错误403

restTemplate Error 403

java

rest

android

csrf-protection