多表单页面的CSRF Token问题及Spring Security中的处理逻辑

Hey there, great question! Let's unpack this step by step:

First off, the short answer is: it depends entirely on your development framework/security library. Some tools generate a single CSRF token per user session that works across all forms on the page, while others might support unique tokens per form (though this is less common, as it adds complexity without meaningful security gains).

Spring Security's Specific Handling #

If you're working with Spring Security, here's exactly how it works out of the box:

• When a user first interacts with your app, Spring Security generates a CSRF token and stores it in their session (using HttpSession by default).
• This one token is reused across every form on the page. You'll typically access it via the _csrf request attribute—for example, Thymeleaf automatically injects it into its form tags, or you can manually render it with ${_csrf.token} and ${_csrf.parameterName} in your templates.
• When any form is submitted, Spring Security checks that the token sent with the request matches the one stored in the user's session. As long as the session is active, all forms share this valid token.

Why Spring Security Uses Session-Scoped Tokens #

• Keep it simple: Reusing a single token avoids the hassle of generating, storing, and validating multiple tokens per page or form.
• Security is still solid: A session-bound token is plenty secure because it's tied directly to the user's session (even anonymous sessions). An attacker can't get hold of this token without session hijacking, which is a separate security concern that CSRF doesn't target.
• Real-world practicality: Per-form tokens don't add meaningful protection for most apps, but they do complicate your form rendering and validation logic unnecessarily.

Can You Do Per-Form Tokens in Spring Security? #

While it's not the default, you could build a custom solution by extending CsrfTokenRepository. For example, you could create a repository that generates unique tokens for each form and tracks them in the user's session. But honestly, this is rarely needed unless you have super specific security requirements that demand it.

内容的提问来源于stack exchange，提问作者samshers