Bidi 发布请求被禁止但获取请求有效

Question

我正在发出这样的获取和发布请求：

(http-cljs.client/get "someurl.com/my")

和

(http-cljs.client/post "someurl.com/my")

在服务器上，我有路由：

{"/my" do-something}

虽然 do-something 与 get 请求一起运行，但它不会与 post 一起运行，并且在客户端中我得到 403 禁止。在响应中，我得到“无效的防伪令牌”。

这些是我正在使用的中间件：

(defn config []
  {:http-port  (Integer. (or (env :port) 5000))
   :middleware [[wrap-defaults site-defaults]
                wrap-with-logger
                wrap-gzip

                [wrap-reload {:dir "../../src"}]

                wrap-params
                wrap-keyword-params
                wrap-json-body
                wrap-edn-params

                ]})

但是，当我使用 api-defaults 时，没有 403 被禁止，它只发生在站点默认值上。为什么会这样？

Answer 1

wrap-defaults 的配置site-defaults 将打开anti-forgery-middleware

如果您查看wrap-anti-forgery 的文档字符串，您会发现：

"Middleware that prevents CSRF attacks. Any POST request to the handler
  returned by this function must contain a valid anti-forgery token, or else an
  access-denied response is returned.

  The anti-forgery token can be placed into a HTML page via the
  *anti-forgery-token* var, which is bound to a (possibly deferred) token.
  The token is also available in the request under
  `:anti-forgery-token`.

  By default, the token is expected to be POSTed in a form field named
  '__anti-forgery-token', or in the 'X-CSRF-Token' or 'X-XSRF-Token'
  headers.

  Accepts the following options:

  :read-token     - a function that takes a request and returns an anti-forgery
                    token, or nil if the token does not exist

  :error-response - the response to return if the anti-forgery token is
                    incorrect or missing

  :error-handler  - a handler function to call if the anti-forgery token is
                    incorrect or missing

  :strategy       - a strategy for creating and validating anti-forgety tokens,
                    which must satisfy the
                    ring.middleware.anti-forgery.strategy/Strategy protocol
                    (defaults to the session strategy:
                    ring.middleware.anti-forgery.session/session-strategy)

  Only one of :error-response, :error-handler may be specified.

表单的防伪用于防止重放攻击。 更多关于 CSRF 攻击的信息：https://en.wikipedia.org/wiki/Cross-site_request_forgery