package com.ricardozuasti.csrf;import com.google.common.cache.Cache;
import com.google.common.cache.CacheBuilder;
import com.google.common.cache.CacheLoader;
import com.google.common.cache.LoadingCache;
import java.io.IOException;
import java.security.SecureRandom;
import java.util.concurrent.ExecutionException;
import java.util.concurrent.TimeUnit;
import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import org.apache.commons.lang.RandomStringUtils;public class LoadSalt implements Filter {@Overridepublic void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)throws IOException, ServletException {// Assume its HTTPHttpServletRequest httpReq = (HttpServletRequest) request;// Check the user session for the salt cache, if none is present we create oneCache<String, Boolean> csrfPreventionSaltCache = (Cache<String, Boolean>)httpReq.getSession().getAttribute("csrfPreventionSaltCache");if (csrfPreventionSaltCache == null){csrfPreventionSaltCache = CacheBuilder.newBuilder().maximumSize(5000).expireAfterWrite(20, TimeUnit.MINUTES).build();httpReq.getSession().setAttribute("csrfPreventionSaltCache", csrfPreventionSaltCache);}// Generate the salt and store it in the users cacheString salt = RandomStringUtils.random(20, 0, 0, true, true, null, new SecureRandom());csrfPreventionSaltCache.put(salt, Boolean.TRUE);// Add the salt to the current request so it can be used// by the page rendered in this requesthttpReq.setAttribute("csrfPreventionSalt", salt);chain.doFilter(request, response);}@Overridepublic void init(FilterConfig filterConfig) throws ServletException {}@Overridepublic void destroy() {}
}

...<filter><filter-name>loadSalt</filter-name><filter-class>com.ricardozuasti.csrf.LoadSalt</filter-class></filter>...<filter-mapping><filter-name>loadSalt</filter-name><url-pattern>*</url-pattern></filter-mapping>...

就像我说的，要在执行安全交易之前验证盐，我们可以编写另一个过滤器：

package com.ricardozuasti.csrf;import com.google.common.cache.Cache;
import java.io.IOException;
import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;public class ValidateSalt implements Filter  {@Overridepublic void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)throws IOException, ServletException {// Assume its HTTPHttpServletRequest httpReq = (HttpServletRequest) request;// Get the salt sent with the requestString salt = (String) httpReq.getParameter("csrfPreventionSalt");// Validate that the salt is in the cacheCache<String, Boolean> csrfPreventionSaltCache = (Cache<String, Boolean>)httpReq.getSession().getAttribute("csrfPreventionSaltCache");if (csrfPreventionSaltCache != null &&salt != null &&csrfPreventionSaltCache.getIfPresent(salt) != null){// If the salt is in the cache, we move onchain.doFilter(request, response);} else {// Otherwise we throw an exception aborting the request flowthrow new ServletException("Potential CSRF detected!! Inform a scary sysadmin ASAP.");}}@Overridepublic void init(FilterConfig filterConfig) throws ServletException {}@Overridepublic void destroy() {}
}

...<filter><filter-name>validateSalt</filter-name><filter-class>com.ricardozuasti.csrf.ValidateSalt</filter-class></filter>...<filter-mapping><filter-name>validateSalt</filter-name><url-pattern>/transferMoneyServlet</url-pattern></filter-mapping>...

...
<form action="/transferMoneyServlet" method="get"><input type="hidden" name="csrfPreventionSalt" value="<c:out value='${csrfPreventionSalt}'/>"/>...
</form>
...

当然，您可以编写一个自定义标签，一个不错的Javascript代码，或在每个所需的链接/表单中添加新参数的方法。

参考： Ricardo Zuasti博客博客上的JCG合作伙伴 Ricardo Zuasti 阻止了Java Web应用程序中的CSRF 。