80: Spring CSRF

1. CSRF에 대하여 설명하시오.

• Cross-site request forgery
• Execute sql query on admin account by hidden url like image tag when the admin was logged in.
• Or the way to prevent CSRF attack.

2. 스프링 시큐리티에서 CSRF를 적용 시키는 방법은?

<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>
<form:form>

3. 아래를 적용해 보세요.

- csrf 를 enable 시 
- 게시판 delete 를 ajax통신으로 구현하시오.

<!--code1-->
<meta name="_csrf" content="${_csrf.token}"/>
<meta name="_csrf_header" content="${_csrf.headerName}"/>

//code2
let token = $("meta[name='_csrf']").attr("content");
let header = $("meta[name='_csrf_header']").attr("content");
$(document).ajaxSend(function(e, xhr, options) {
    xhr.setRequestHeader(header, token);
});

//code3
let ajaxDelete = function(pnumber) {
	$.ajax({
		type: "delete",
		url: "/board/ajax_delete",
		data: 
		{
			'pnumber': pnumber
		},
		//async: false,
		success: function(data, status) {
		},
	});
};