由于 CSRF 攻击，Wicket + websocket 页面不刷新答案

【问题标题】：Wicket + websocket page not refreshing because CSRF attack由于 CSRF 攻击，Wicket + websocket 页面不刷新
【发布时间】：2022-01-03 07:41:20
【问题描述】：

在我的应用程序中，我需要使用 websocket。我遵循this 示例，所以在我的检票口应用程序中我得到了：

@Bean
public FilterRegistrationBean wicketFilter() {
    final FilterRegistrationBean wicketFilter = new FilterRegistrationBean();
    wicketFilter.setDispatcherTypes(DispatcherType.REQUEST, DispatcherType.ERROR, DispatcherType.FORWARD,
            DispatcherType.ASYNC);
    wicketFilter.setAsyncSupported(true);
    wicketFilter.setFilter(new JavaxWebSocketFilter());
    wicketFilter.addInitParameter(WicketFilter.APP_FACT_PARAM, SpringWebApplicationFactory.class.getName());
    wicketFilter.addInitParameter(WicketFilter.FILTER_MAPPING_PARAM, "/*");
    wicketFilter.addUrlPatterns("/*");
    return wicketFilter;
}

@Bean
public WicketServerEndpointConfig wicketServerEndpointConfig() {
    return new WicketServerEndpointConfig();
}

并在页面中添加行为：

private void addWebSocketUpdating() {
    add(new WebSocketBehavior() {
        private static final long serialVersionUID = 1L;

        @Override
        protected void onConnect(ConnectedMessage message) {
            super.onConnect(message);

            webSocketService.addClient(message);
        }

        @Override
        protected void onPush(WebSocketRequestHandler handler, IWebSocketPushMessage message) {
            super.onPush(handler, message);

            if (message instanceof WSMessage) {
                WSMessage msg = (WSMessage) message;
                if (msg.isAdd()) {
                    model.getObject().getPickupFindingParticipants().add(msg.getParticipant());
                } else if (msg.isDelete()) {
                    model.getObject().getPickupFindingParticipants().remove(msg.getParticipant());
                }
            }
            handler.add(PickupFindPage.this);
        }
    });
}

添加逻辑

public void addParticipant(PickupParticipantDto participant) {
    if (null != broadcaster) {
        WSMessage message = new WSMessage(participant);
        message.setAdd(true);

        broadcaster.broadcastAll(connections.listIterator().next().getApplication(), message);
    } else {
        throw new RuntimeException("WebSockets can not send message");
    }
}

但是当页面应该刷新时，我在日志中收到警告：

2021-11-25 00:23:55.635 [Wicket-WebSocket-HttpRequest-Thread-1] INFO  o.a.w.p.h.CsrfPreventionRequestCycleListener Possible CSRF attack, request URL: ws://localhost:7002/wicket/websocket?pageId=5&wicket-ajax-baseurl=pickup%2F19%2Ffind%3F5&wicket-app-name=javaxWebSocketFilter, Origin: null, action: allowed
2021-11-25 00:23:55.635 [Wicket-WebSocket-HttpRequest-Thread-1] INFO  o.a.w.p.h.CsrfPreventionRequestCycleListener Possible CSRF attack, request URL: ws://localhost:7002/wicket/websocket?pageId=5&wicket-ajax-baseurl=pickup%2F19%2Ffind%3F5&wicket-app-name=javaxWebSocketFilter, Origin: null, action: allowed
2021-11-25 00:23:55.635 [Wicket-WebSocket-HttpRequest-Thread-0] INFO  o.a.w.p.h.CsrfPreventionRequestCycleListener Possible CSRF attack, request URL: ws://localhost:7002/wicket/websocket?pageId=7&wicket-ajax-baseurl=pickup%2F19%2Ffind%3F7&wicket-app-name=javaxWebSocketFilter, Origin: null, action: allowed
2021-11-25 00:23:55.635 [Wicket-WebSocket-HttpRequest-Thread-0] INFO  o.a.w.p.h.CsrfPreventionRequestCycleListener Possible CSRF attack, request URL: ws://localhost:7002/wicket/websocket?pageId=7&wicket-ajax-baseurl=pickup%2F19%2Ffind%3F7&wicket-app-name=javaxWebSocketFilter, Origin: null, action: allowed
2021-11-25 00:23:55.635 [Wicket-WebSocket-HttpRequest-Thread-1] WARN  o.a.wicket.page.PartialPageUpdate Component '[Page class = org.tomass.dota.rattlebot.web.pages.tournament.pickup.PickupFindPage, id = 5, render count = 1]' not rendered because it was already removed from page
2021-11-25 00:23:55.635 [Wicket-WebSocket-HttpRequest-Thread-0] WARN  o.a.wicket.page.PartialPageUpdate Component '[Page class = org.tomass.dota.rattlebot.web.pages.tournament.pickup.PickupFindPage, id = 7, render count = 1]' not rendered because it was already removed from page

并建议我做错了什么？

【问题讨论】：

标签： java spring-boot websocket wicket