{"id":195161,"date":"2024-05-09T21:51:34","date_gmt":"2024-05-09T13:51:34","guid":{"rendered":"https:\/\/docs.pingcode.com\/ask\/ask-ask\/195161.html"},"modified":"2024-05-09T21:51:37","modified_gmt":"2024-05-09T13:51:37","slug":"%e5%89%8d%e5%90%8e%e7%ab%af%e5%88%86%e7%a6%bb%ef%bc%8ccsrftoken%e6%98%af%e5%ad%98%e5%9c%a8%e5%93%aa%e9%87%8c%e7%9a%84%e5%95%8a","status":"publish","type":"post","link":"https:\/\/docs.pingcode.com\/ask\/ask-ask\/195161.html","title":{"rendered":"\u524d\u540e\u7aef\u5206\u79bb\uff0ccsrftoken\u662f\u5b58\u5728\u54ea\u91cc\u7684\u554a"},"content":{"rendered":"

\"\u524d\u540e\u7aef\u5206\u79bb\uff0ccsrftoken\u662f\u5b58\u5728\u54ea\u91cc\u7684\u554a\"<\/p>\n

\u524d\u540e\u7aef\u5206\u79bb\u7684\u67b6\u6784\u4e2d\uff0cCSRFToken<\/strong>\u901a\u5e38\u5b58\u5728\u5ba2\u6237\u7aef\u6d4f\u89c8\u5668\u7684Cookie\u4e2d<\/strong>\u3001\u8bf7\u6c42\u7684Header\u4e2d<\/strong>\u3002<\/p>\n<\/p>\n

\u5728\u524d\u540e\u7aef\u5206\u79bb\u7684\u67b6\u6784\u4e0b\uff0c\u4e3a\u4e86\u9632\u6b62\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\uff08CSRF\uff09\u653b\u51fb\uff0c\u5e94\u7528\u4f1a\u751f\u6210\u4e00\u4e2a\u72ec\u4e00\u65e0\u4e8c\u7684CSRFToken\uff0c\u6765\u4fdd\u8bc1\u6bcf\u6b21\u8bf7\u6c42\u7684\u5408\u6cd5\u6027\u3002\u6700\u5e38\u89c1\u7684\u505a\u6cd5\u662f\uff0c\u670d\u52a1\u7aef\u751f\u6210 CSRFToken \u540e\uff0c\u901a\u5e38\u4f1a\u628a\u5b83\u5b58\u50a8\u5728\u5ba2\u6237\u7aef\u7684Cookie\u4e2d\uff0c\u800c\u5ba2\u6237\u7aef\u5728\u53d1\u8d77\u9700\u8981\u9a8c\u8bc1\u7684\u64cd\u4f5c\uff08\u5982\u8868\u5355\u63d0\u4ea4\uff09\u65f6\uff0c\u4f1a\u4eceCookie\u4e2d\u53d6\u51fa\u8fd9\u4e2aToken\uff0c\u5e76\u5c06\u5b83\u901a\u8fc7\u8bf7\u6c42\u5934\u6216\u8005\u8bf7\u6c42\u4f53\u7684\u67d0\u4e2a\u5b57\u6bb5\u53d1\u9001\u7ed9\u670d\u52a1\u5668\u3002\u670d\u52a1\u5668\u63a5\u6536\u5230\u8bf7\u6c42\u540e\uff0c\u4f1a\u9a8c\u8bc1\u8bf7\u6c42\u4e2d\u7684CSRFToken\u662f\u5426\u4e0e\u670d\u52a1\u5668\u751f\u6210\u7684\u4e00\u81f4\uff0c\u4ece\u800c\u5224\u65ad\u8bf7\u6c42\u7684\u5408\u6cd5\u6027\u3002<\/p>\n<\/p>\n

\u73b0\u5728\u8ba9\u6211\u4eec\u8fdb\u4e00\u6b65\u8be6\u7ec6\u4e86\u89e3CSRFToken\u7684\u5b58\u50a8\u548c\u4f7f\u7528\u673a\u5236\u3002<\/p>\n<\/p>\n

\u4e00\u3001CSRF\u7b80\u4ecb<\/h3>\n<\/p>\n

\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\uff08CSRF\uff09\u662f\u4e00\u79cd\u5e38\u89c1\u7684Web\u653b\u51fb\u6280\u672f\uff0c\u653b\u51fb\u8005\u8bf1\u5bfc\u7528\u6237\u5728\u6d4f\u89c8\u5668\u4e2d\u8fdb\u884c\u975e\u9884\u671f\u7684\u4e2a\u4eba\u64cd\u4f5c\uff0c\u5982\u8f6c\u8d26\u3001\u4fee\u6539\u5bc6\u7801\u7b49\u3002\u4e3a\u4e86\u9632\u62a4\u8fd9\u79cd\u653b\u51fb\uff0c\u901a\u5e38\u9700\u8981\u5728\u8bf7\u6c42\u4e2d\u9644\u5e26\u4e00\u4e2a\u670d\u52a1\u5668\u548c\u7528\u6237\u90fd\u53ef\u4ee5\u9a8c\u8bc1\u7684Token\u3002<\/p>\n<\/p>\n

\u4e8c\u3001\u5b58\u50a8\u4f4d\u7f6e<\/h3>\n<\/p>\n

1. \u5b58\u50a8\u5728Cookie<\/h4>\n<\/p>\n

\u5c06CSRFToken\u5b58\u50a8\u5728Cookie\u4e2d\u662f\u4e00\u79cd\u6bd4\u8f83\u5e38\u89c1\u7684\u505a\u6cd5\u3002\u670d\u52a1\u5668\u751f\u6210CSRFToken\u540e\uff0c\u4f1a\u5c06\u8fd9\u4e2aToken\u4ee5Set-Cookie\u7684\u65b9\u5f0f\u53d1\u9001\u7ed9\u5ba2\u6237\u7aef\u6d4f\u89c8\u5668<\/strong>\u3002\u4e4b\u540e\uff0c\u6d4f\u89c8\u5668\u4f1a\u81ea\u52a8\u5c06\u8fd9\u4e2aToken\u4fdd\u5b58\uff0c\u5e76\u5728\u4e4b\u540e\u7684\u6bcf\u4e2a\u8bf7\u6c42\u4e2d\u90fd\u81ea\u52a8\u9644\u52a0\u8fd9\u4e2aCookie\uff0c\u4ee5\u4fbf\u670d\u52a1\u7aef\u9a8c\u8bc1\u3002<\/p>\n<\/p>\n

\u82e5\u8981\u624b\u52a8\u4eceCookie\u4e2d\u8bfb\u53d6Token\uff0c\u53ef\u4ee5\u901a\u8fc7JavaScript\u7684document.cookie<\/code>\u5c5e\u6027\u6765\u5b9e\u73b0\u3002\u4f46\u8981\u6ce8\u610f\u7684\u662f\uff0c\u4e3a\u4e86\u5b89\u5168\u8d77\u89c1\uff0c\u670d\u52a1\u7aef\u5728\u8bbe\u7f6eCookie\u65f6\u5f80\u5f80\u4f1a\u4f7f\u7528HttpOnly\u5c5e\u6027\uff0c\u8fd9\u610f\u5473\u7740\u8fd9\u4e9bCookie\u5c06\u4e0d\u80fd\u901a\u8fc7JavaScript\u76f4\u63a5\u8bbf\u95ee\uff0c\u4ee5\u6b64\u6765\u51cf\u5c11XSS\u653b\u51fb\u7684\u98ce\u9669\u3002<\/p>\n<\/p>\n

2. \u5b58\u50a8\u5728Header<\/h4>\n<\/p>\n

\u5728\u67d0\u4e9b\u60c5\u51b5\u4e0b\uff0cCSRFToken\u53ef\u80fd\u76f4\u63a5\u5728\u670d\u52a1\u7aef\u7684\u54cd\u5e94Header\u4e2d\u8fd4\u56de<\/strong>\uff0c\u5e76\u4e14\u8981\u6c42\u5ba2\u6237\u7aef\u5728\u540e\u7eed\u7684\u8bf7\u6c42Header\u4e2d\u9644\u5e26\u8fd9\u4e2aToken\u3002\u8fd9\u901a\u5e38\u662f\u901a\u8fc7\u81ea\u5b9a\u4e49\u7684HTTP\u5934\u5b9e\u73b0\u7684\uff0c\u6bd4\u5982X-CSRF-Token<\/code>\u3002\u5ba2\u6237\u7aef\u53d1\u8d77\u8bf7\u6c42\u65f6\uff0c\u9700\u8981\u8bfb\u53d6\u5b58\u50a8\u5728\u67d0\u5904\uff08\u5982localStorage\u3001sessionStorage\u6216\u5176\u4ed6\u5ba2\u6237\u7aef\u5b58\u50a8\u673a\u5236\uff09\u7684Token\uff0c\u7136\u540e\u624b\u52a8\u5c06\u8fd9\u4e2aToken\u6dfb\u52a0\u5230\u8bf7\u6c42\u5934\u4e2d\u3002<\/p>\n<\/p>\n

\u4e09\u3001Token\u751f\u6210\u4e0e\u9a8c\u8bc1<\/h3>\n<\/p>\n

1. Token\u751f\u6210<\/h4>\n<\/p>\n

\u751f\u6210CSRFToken\u901a\u5e38\u9700\u8981\u786e\u4fdd\u5176\u662f\u968f\u673a\u4e14\u72ec\u7279\u7684<\/strong>\uff0c\u4ee5\u907f\u514d\u653b\u51fb\u8005\u80fd\u591f\u9884\u6d4b\u6216\u590d\u5236Token\u3002\u5728\u670d\u52a1\u7aef\uff0c\u751f\u6210Token\u901a\u5e38\u6d89\u53ca\u5230\u5b89\u5168\u7684\u968f\u673a\u6570\u751f\u6210\u5668\u6765\u4fdd\u8bc1Token\u7684\u968f\u673a\u6027\u3002<\/p>\n<\/p>\n

2. Token\u9a8c\u8bc1<\/h4>\n<\/p>\n

\u5f53\u8bf7\u6c42\u53d1\u8d77\u65f6\uff0c\u670d\u52a1\u7aef\u4f1a\u68c0\u67e5\u8bf7\u6c42\u4e2d\u7684Token\u662f\u5426\u5b58\u5728\uff0c\u5e76\u4e0e\u670d\u52a1\u7aef\u5b58\u50a8\u7684Token\u8fdb\u884c\u6bd4\u5bf9\u3002\u82e5Token\u4e0d\u5339\u914d\u6216\u7f3a\u5931\uff0c\u670d\u52a1\u7aef\u5c06\u62d2\u7edd\u8fd9\u4e2a\u8bf7\u6c42<\/strong>\u3002<\/p>\n<\/p>\n

\u56db\u3001\u5728\u524d\u540e\u7aef\u5206\u79bb\u4e2d\u7684\u5e94\u7528<\/h3>\n<\/p>\n

\u524d\u540e\u7aef\u5206\u79bb\u7684\u9879\u76ee\u4e2d\uff0c\u524d\u7aef\u901a\u5e38\u662f\u4f5c\u4e3a\u72ec\u7acb\u7684\u9759\u6001\u9875\u9762\u6258\u7ba1\uff0c\u4e0e\u540e\u7aef\u7684API\u670d\u52a1\u5668\u5206\u5f00\u90e8\u7f72\u3002\u5728\u8fd9\u79cd\u60c5\u51b5\u4e0b\uff0cCSRF\u9632\u5fa1\u673a\u5236\u7684\u5b9e\u73b0\u9700\u8981\u524d\u540e\u7aef\u5171\u540c\u534f\u4f5c\u3002<\/p>\n<\/p>\n

1. \u8bf7\u6c42\u8fc7\u7a0b\u4e2d\u7684CSRFToken\u5904\u7406<\/h4>\n<\/p>\n

\u5728\u5ba2\u6237\u7aef\u53d1\u8d77\u654f\u611f\u64cd\u4f5c\u8bf7\u6c42\u524d\uff0c\u9700\u8981\u4eceCookie\u6216\u5176\u4ed6\u5b58\u50a8\u4e2d\u63d0\u53d6CSRFToken\uff0c\u5e76\u5c06\u5176\u9644\u52a0\u5230\u8bf7\u6c42\u5934\u6216\u8bf7\u6c42\u4f53\u4e2d<\/strong>\u3002\u8fd9\u8981\u6c42\u524d\u7aef\u5f00\u53d1\u8005\u5728\u7f16\u5199AJAX\u8bf7\u6c42\u6216\u4f7f\u7528\u524d\u7aef\u6846\u67b6\u7684HTTP\u5ba2\u6237\u7aef\u65f6\uff0c\u5fc5\u987b\u8bb0\u5f97\u6dfb\u52a0\u76f8\u5e94\u7684\u4ee3\u7801\u8fdb\u884cToken\u7684\u5904\u7406\u3002<\/p>\n<\/p>\n

2. \u540e\u7aef\u7684Token\u9a8c\u8bc1\u903b\u8f91<\/h4>\n<\/p>\n

\u540e\u7aef\u63a5\u6536\u5230\u8bf7\u6c42\u540e\uff0c\u9664\u4e86\u6821\u9a8c\u8eab\u4efd\u8ba4\u8bc1\u4fe1\u606f\u5916\uff0c\u8fd8\u9700\u8981\u989d\u5916\u6821\u9a8c\u8bf7\u6c42\u4e2d\u7684CSRFToken\u3002\u8fd9\u9700\u8981\u5728\u540e\u7aef\u8bbe\u7f6e\u5408\u9002\u7684\u6821\u9a8c\u8fc7\u7a0b\uff0c\u5e76\u5728\u6821\u9a8c\u5931\u8d25\u65f6\u8fd4\u56de\u6070\u5f53\u7684\u9519\u8bef\u54cd\u5e94<\/strong>\u3002<\/p>\n<\/p>\n

\u7efc\u4e0a\u6240\u8ff0\uff0cCSRFToken\u5728\u524d\u540e\u7aef\u5206\u79bb\u7684\u67b6\u6784\u4e2d\u662f\u4f5c\u4e3a\u91cd\u8981\u7684\u5b89\u5168\u51ed\u8bc1\u5b58\u5728\uff0c\u53ef\u4ee5\u901a\u8fc7Cookie\u6216\u81ea\u5b9a\u4e49Header\u7684\u65b9\u5f0f\u5728\u5ba2\u6237\u7aef\u4e0e\u670d\u52a1\u7aef\u4e4b\u95f4\u4f20\u9012\u3002\u5b9e\u73b0\u5408\u7406\u7684CSRF\u9632\u5fa1\u673a\u5236\u662f\u4fdd\u62a4Web\u5e94\u7528\u5b89\u5168\u7684\u5173\u952e\u6b65\u9aa4\u4e4b\u4e00\u3002<\/p>\n<\/p>\n

\u76f8\u5173\u95ee\u7b54FAQs\uff1a<\/strong><\/h2>\n

1. CSRF Token\u662f\u5982\u4f55\u5728\u524d\u540e\u7aef\u5206\u79bb\u67b6\u6784\u4e2d\u8fdb\u884c\u5b58\u50a8\u7684\uff1f<\/strong>
\n\u5728\u524d\u540e\u7aef\u5206\u79bb\u67b6\u6784\u4e2d\uff0cCSRFToken\u901a\u5e38\u4f5c\u4e3a\u4e00\u4e2acookie\u8fdb\u884c\u5b58\u50a8\u3002\u5f53\u7528\u6237\u767b\u5f55\u6216\u901a\u8fc7\u8868\u5355\u63d0\u4ea4\u65f6\uff0c\u670d\u52a1\u5668\u4f1a\u751f\u6210\u4e00\u4e2a\u5305\u542bCSRFToken\u7684cookie\uff0c\u5e76\u53d1\u9001\u7ed9\u6d4f\u89c8\u5668\u5b58\u50a8\u3002\u7136\u540e\uff0c\u6bcf\u5f53\u8fdb\u884cHTTP\u8bf7\u6c42\u65f6\uff0c\u6d4f\u89c8\u5668\u4f1a\u81ea\u52a8\u5c06\u6b64cookie\u6dfb\u52a0\u5230\u8bf7\u6c42\u5934\u4e2d\uff0c\u670d\u52a1\u5668\u4ece\u8bf7\u6c42\u5934\u4e2d\u63d0\u53d6CSRFToken\u8fdb\u884c\u9a8c\u8bc1\u3002<\/p>\n

2. \u524d\u540e\u7aef\u5206\u79bb\u4e2d\uff0c\u4e3a\u4ec0\u4e48\u9700\u8981\u4f7f\u7528CSRFToken\u8fdb\u884c\u9632\u5fa1\uff1f<\/strong>
\nCSRF\uff08Cross-Site Request Forgery\uff09\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u662f\u4e00\u79cd\u5e38\u89c1\u7684\u7f51\u7edc\u653b\u51fb\u65b9\u5f0f\uff0c\u653b\u51fb\u8005\u5229\u7528\u7528\u6237\u5df2\u767b\u5f55\u7684\u8eab\u4efd\u53d1\u8d77\u6076\u610f\u8bf7\u6c42\uff0c\u4ee5\u8fbe\u5230\u7be1\u6539\u7528\u6237\u6570\u636e\u6216\u6267\u884c\u975e\u6cd5\u64cd\u4f5c\u7684\u76ee\u7684\u3002\u901a\u8fc7\u4f7f\u7528CSRFToken\u8fdb\u884c\u9632\u5fa1\uff0c\u53ef\u4ee5\u5728\u7528\u6237\u8fdb\u884c\u654f\u611f\u64cd\u4f5c\u65f6\u9a8c\u8bc1\u8bf7\u6c42\u7684\u5408\u6cd5\u6027\uff0c\u9632\u6b62CSRF\u653b\u51fb\u3002<\/p>\n

3. \u9664\u4e86\u901a\u8fc7cookie\u5b58\u50a8\uff0c\u8fd8\u6709\u4ec0\u4e48\u5176\u4ed6\u7684\u5b58\u50a8\u65b9\u5f0f\u53ef\u4ee5\u4f7f\u7528CSRFToken\uff1f<\/strong>
\n\u9664\u4e86\u5728cookie\u4e2d\u5b58\u50a8CSRFToken\uff0c\u8fd8\u53ef\u4ee5\u5c06\u8be5Token\u5b58\u50a8\u5728\u6d4f\u89c8\u5668\u7684\u672c\u5730\u5b58\u50a8\uff08\u4f8b\u5982LocalStorage\u6216SessionStorage\uff09\u4e2d\u3002\u8fd9\u79cd\u65b9\u5f0f\u53ef\u4ee5\u63d0\u4f9b\u8de8\u9875\u9762\u7684\u9a8c\u8bc1\u80fd\u529b\uff0c\u5e76\u4e14\u53ef\u4ee5\u51cf\u5c11\u5bf9cookie\u7684\u4f9d\u8d56\u3002\u4e0d\u8fc7\u9700\u8981\u6ce8\u610f\u7684\u662f\uff0c\u4f7f\u7528\u672c\u5730\u5b58\u50a8\u5b58\u50a8CSRFToken\u9700\u8981\u989d\u5916\u7684\u524d\u7aef\u7f16\u7801\u5de5\u4f5c\uff0c\u4ee5\u786e\u4fdd\u5b89\u5168\u6027\u548c\u4e00\u81f4\u6027\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"\u524d\u540e\u7aef\u5206\u79bb\u7684\u67b6\u6784\u4e2d\uff0cCSRFToken\u901a\u5e38\u5b58\u5728\u5ba2\u6237\u7aef\u6d4f\u89c8\u5668\u7684Cookie\u4e2d\u3001\u8bf7\u6c42\u7684Header\u4e2d\u3002 \u5728\u524d\u540e\u7aef\u5206 […]","protected":false},"author":3,"featured_media":195162,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[37],"tags":[],"acf":[],"_links":{"self":[{"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/posts\/195161"}],"collection":[{"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/comments?post=195161"}],"version-history":[{"count":0,"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/posts\/195161\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/media\/195162"}],"wp:attachment":[{"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/media?parent=195161"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/categories?post=195161"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/tags?post=195161"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}