Spring Security（六）防御会话过期攻击

末蓝、 2023-06-05 15:58 6阅读 0赞

防御会话固定攻击的方法非常简单，只需在用户登录之后重新生成新的session即可。在继承WebSecurityConfigurerAdapter时，Spring Security已经启用了该配置。

protected final HttpSecurity getHttp() throws Exception {
            if (this.http != null) {
                return this.http;
            } else {
                DefaultAuthenticationEventPublisher eventPublisher = (DefaultAuthenticationEventPublisher)this.objectPostProcessor.postProcess(new DefaultAuthenticationEventPublisher());
                this.localConfigureAuthenticationBldr.authenticationEventPublisher(eventPublisher);
                AuthenticationManager authenticationManager = this.authenticationManager();
                this.authenticationBuilder.parentAuthenticationManager(authenticationManager);
                this.authenticationBuilder.authenticationEventPublisher(eventPublisher);
                Map<Class<? extends Object>, Object> sharedObjects = this.createSharedObjects();
                this.http = new HttpSecurity(this.objectPostProcessor, this.authenticationBuilder, sharedObjects);
                if (!this.disableDefaults) {
                    ((HttpSecurity)((DefaultLoginPageConfigurer)((HttpSecurity)((HttpSecurity)((HttpSecurity)((HttpSecurity)((HttpSecurity)((HttpSecurity)((HttpSecurity)((HttpSecurity)this.http.csrf().and()).addFilter(new WebAsyncManagerIntegrationFilter()).exceptionHandling().and()).headers().and())
    				.sessionManagement()// 此处调用sessionManagement
    				.and()).securityContext().and()).requestCache().and()).anonymous().and()).servletApi().and()).apply(new DefaultLoginPageConfigurer())).and()).logout();
                    ClassLoader classLoader = this.context.getClassLoader();
                    List<AbstractHttpConfigurer> defaultHttpConfigurers = SpringFactoriesLoader.loadFactories(AbstractHttpConfigurer.class, classLoader);
                    Iterator var6 = defaultHttpConfigurers.iterator();
    
                    while(var6.hasNext()) {
                        AbstractHttpConfigurer configurer = (AbstractHttpConfigurer)var6.next();
                        this.http.apply(configurer);
                    }
                }
    
                this.configure(this.http);
                return this.http;
            }

sessionManagement是一个会话管理的配置器，其中，防御会话固定攻击的策略有四种：

*  none：不做任何变动，登录之后沿用旧的session。
 *  newSession：登录之后创建一个新的session。
 *  migrateSession：登录之后创建一个新的session，并将旧的session中的数据复制过来。
 *  changeSessionId：不创建新的会话，而是使用Servlet容器提供的会话固定保护。

Spring Security默认已经启用migrateSession策略，如有必要，可以做出修改。