Spring Security 3.2, CSRF and Multiple Requests

Question

This question is related to the question at this Spring URL Security 3.2 CSRF support for multiprocessor requests

I tried this same setup as well as the gist, but I can't get this to work if I don't have the _csrf token in the url. I had this in the form of a body as a hidden field and had a filter specified in front of the security filter, but without joy, and every time it failed with a debug log message of an invalid csrf token

Any help on this would be greatly appreciated.

Cheers damien

Answer 1

It would be very difficult to find without an entity, but I finally got it!

Spring. SpringFramework. - ( _csrf, file), , , CsrfFilter. , Requested parameter file absent ( - ...)

Spring Framework manual, multipart :

• Apache

• 3.0

  • CommonsMultipartResolver mvc-dispatcher-servlet.xml. , MultipartFilter ServletContext MultipartResolver .

  , Apache pom.xml.

  , pom.xml

  <dependency>
      <groupId>commons-fileupload</groupId>
      <artifactId>commons-fileupload</artifactId>
      <version>1.3.1</version>
  </dependency>
  

  filterMultipartResolver bean mvc-dispatcher-servlet.xml . , spring-security.xml:

  <beans:bean id="filterMultipartResolver"
        class="org.springframework.web.multipart.commons.CommonsMultipartResolver">
      <beans:property name="maxUploadSize" value="100000000" />
  </beans:bean>
  

  2. 3.0. apache, bean, MultipartFilter StandardServletMultipartResolver .

<multipart-config> DispatcherServlet web.xml

<servlet>
    <servlet-name>dispatcher</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <multipart-config>
        <!--location>/tmp</location-->
        <max-file-size>1000000</max-file-size>
    </multipart-config>
</servlet>