HTTP Status 403 - Expected CSRF token not found.Has session expired?

问题

I have a Spring MVC application, view layer is jsp based.At times I get this error message and this message is true, session really got expired.If I login once again then it is all fine. I am using following mechanism to send CSRF token: In head section 2 meta tags are added:

<meta name="_csrf" content="${_csrf.token}" /> 
<meta name="_csrf_header" content="${_csrf.headerName}" />

In every Ajax call,token and header are retrieved:

var token = $("meta[name='_csrf']").attr("content");
var header = $("meta[name='_csrf_header']").attr("content");

Then with XMLHttpRequest this header & token are sent:

$.ajax({
        type : "GET",
        url : xxx,

        beforeSend : function(xhr) {
            xhr.setRequestHeader(header, token);
        },
        complete : function() {
        },
        success : function(response) {
        }       
});

This is how it is in most jsp pages.I have tried to capture the token in an alert message & it works. I want to redirect the user to the login page if the session has expired via a page which will show why the user is getting redirected. How to go about this?

In the server side Spring we have used xml based configuraton:

<http auto-config="true"  use-expressions="true">
  ...
  <csrf/>
</http>

回答1:

I added following to application-security.xml which solved the problem for this particular scenario, though I am facing CSRF exception in some other scenario :

<http auto-config="true"  use-expressions="true">
...

<session-management invalid-session-url="/login">
        <concurrency-control expired-url="/login" />
    </session-management>
</http>

来源：https://stackoverflow.com/questions/57440160/http-status-403-expected-csrf-token-not-found-has-session-expired

标签

spring-mvc

jsp

csrf