Spring SecurityのCSRF対策 - トークン管理とSPA対応の設定

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

public interface CsrfToken extends Serializable {
    // HTTPリクエストヘッダー名（デフォルト: X-CSRF-TOKEN）
    String getHeaderName();
    
    // リクエストパラメータ名（デフォルト: _csrf）
    String getParameterName();
    
    // 実際のトークン値
    String getToken();
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            // CSRF保護はデフォルトで有効
            .csrf(Customizer.withDefaults());
        
        return http.build();
    }
}

1
2
3
4
5
6
7
8
9

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .csrf(csrf -> csrf
            .csrfTokenRepository(new HttpSessionCsrfTokenRepository())
        );
    
    return http.build();
}

1
2
3
4
5
6
7
8
9

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .csrf(csrf -> csrf
            .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
        );
    
    return http.build();
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

@Configuration
@EnableWebSecurity
public class SpaSecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.spa())
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/api/public/**").permitAll()
                .anyRequest().authenticated()
            );
        
        return http.build();
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

@Configuration
@EnableWebSecurity
public class SpaSecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
                .csrfTokenRequestHandler(new SpaCsrfTokenRequestHandler())
            )
            .authorizeHttpRequests(authorize -> authorize
                .anyRequest().authenticated()
            );
        
        return http.build();
    }
}

final class SpaCsrfTokenRequestHandler implements CsrfTokenRequestHandler {
    
    private final CsrfTokenRequestHandler plain = new CsrfTokenRequestAttributeHandler();
    private final CsrfTokenRequestHandler xor = new XorCsrfTokenRequestAttributeHandler();

    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response, 
                       Supplier<CsrfToken> csrfToken) {
        // CsrfTokenをリクエスト属性として利用可能にする
        xor.handle(request, response, csrfToken);
        // CSRFトークンを読み込み、Cookieを生成する
        csrfToken.get();
    }

    @Override
    public String resolveCsrfTokenValue(HttpServletRequest request, CsrfToken csrfToken) {
        String headerValue = request.getHeader(csrfToken.getHeaderName());
        // Cookieからの値はプレーンテキストとして解決
        // フォームからの値はBREACH保護のためXORで解決
        return (StringUtils.hasText(headerValue) ? plain : xor)
            .resolveCsrfTokenValue(request, csrfToken);
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

// Cookieからトークンを取得するユーティリティ関数
function getCookie(name) {
    const value = `; ${document.cookie}`;
    const parts = value.split(`; ${name}=`);
    if (parts.length === 2) {
        return parts.pop().split(';').shift();
    }
    return null;
}

// APIリクエストの送信
async function postData(url, data) {
    const csrfToken = getCookie('XSRF-TOKEN');
    
    const response = await fetch(url, {
        method: 'POST',
        headers: {
            'Content-Type': 'application/json',
            'X-XSRF-TOKEN': csrfToken  // CSRFトークンをヘッダーに含める
        },
        credentials: 'include',  // Cookieを送信
        body: JSON.stringify(data)
    });
    
    return response.json();
}

1
2
3
4
5
6
7
8
9

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .csrf(csrf -> csrf
            .csrfTokenRequestHandler(new CsrfTokenRequestAttributeHandler())
        );
    
    return http.build();
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

@Configuration
@EnableWebSecurity
public class ApiSecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            )
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/api/public/**").permitAll()
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(Customizer.withDefaults())
            );
        
        return http.build();
    }
}

1
2
3
4
5
6
7
8
9

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .csrf(csrf -> csrf
            .ignoringRequestMatchers("/api/webhook/**", "/api/public/**")
        );
    
    return http.build();
}

1
2
3
4
5
6
7
8

@RestController
public class CsrfController {

    @GetMapping("/csrf")
    public CsrfToken csrf(CsrfToken csrfToken) {
        return csrfToken;
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .csrf(csrf -> csrf
            .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
        )
        .authorizeHttpRequests(authorize -> authorize
            .requestMatchers("/csrf").permitAll()
            .anyRequest().authenticated()
        );
    
    return http.build();
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.*;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;

@SpringBootTest
@AutoConfigureMockMvc
class CsrfProtectionTest {

    @Autowired
    private MockMvc mockMvc;

    @Test
    void postWithValidCsrfToken_shouldSucceed() throws Exception {
        mockMvc.perform(post("/api/data")
                .with(csrf())  // CSRFトークンを含める
                .contentType(MediaType.APPLICATION_JSON)
                .content("{\"name\": \"test\"}"))
            .andExpect(status().isOk());
    }

    @Test
    void postWithoutCsrfToken_shouldReturn403() throws Exception {
        mockMvc.perform(post("/api/data")
                .contentType(MediaType.APPLICATION_JSON)
                .content("{\"name\": \"test\"}"))
            .andExpect(status().isForbidden());
    }

    @Test
    void postWithInvalidCsrfToken_shouldReturn403() throws Exception {
        mockMvc.perform(post("/api/data")
                .with(csrf().useInvalidToken())
                .contentType(MediaType.APPLICATION_JSON)
                .content("{\"name\": \"test\"}"))
            .andExpect(status().isForbidden());
    }
}