springsecurity中CSRF中设置不针对某些请求过滤



...






但如果某些URL不想加入CSRF&＃xff0c;可以使用下面的办法&＃xff1a;



实现RequestMatcher.这个接口中的方法&＃xff0c;在这里排除某些URL不做CSRF&＃xff0c;比如&＃xff1a;


public class CsrfSecurityRequestMatcher implements RequestMatcher {
private Pattern allowedMethods &＃61; Pattern.compile("^(GET|HEAD|TRACE|OPTIONS)$");
private RegexRequestMatcher unprotectedMatcher &＃61; new RegexRequestMatcher("/unprotected", null);

&＃64;Override
public boolean matches(HttpServletRequest request) {
if(allowedMethods.matcher(request.getMethod()).matches()){
return false;
}

return !unprotectedMatcher.matches(request);
}
}




这里&＃xff0c;就是针对/unproted开头的URL&＃xff0c;都不用做CSRF了

然后在配置文件中&＃xff1a;