为什么我的Python POST可以工作，但我的Java POST会出现CSRF错误

Question

我正试图发送一个包含一些数据的POST，我想为它创建一个应用程序，我有可运行的Python代码，但在让Java对应程序运行时遇到了问题。Python:

headerpayload = {
'X-Requested-With': 'XMLHttpRequest',
'Host': host,
'Origin': origin,
'Referer': login_url,
'__RequestVerificationToken': veri_token
}
payload = {
"__RequestVerificationToken": veri_token,
"Q_b9849eb2-813d-4d0a-a1ce-643f1c8af986_0": "test",
"Q_62ebd8c8-7d45-481d-a8b1-ad54a390a029_0": "[e-mail]",
"Q_f4a3bb2e-ebab-4660-a9a1-75c0d79fe0b4_0": "",
"Q_20cd46d1-3b95-46ad-81a3-b7b4d7fe7bf9_0": "b9558536-87d3-4395-aceb-ac3e012b4bad",
"Q_012d8ddf-e75a-4266-ae78-f59502862aa9_0": "Bay 4",
"Q_6b61b457-f325-41d7-9784-5cb4a959223f_0": "Superman",
"FormId": "276caa59-80a5-4ced-9b9d-025e1d753b4a",
"_ACTION": "Continue",
"PageIndex": "1"
}
result = session_requests.post(
login_url,
data=payload,
headers=headerpayload
)

安卓系统：(OkHttp(

RequestBody requestBody = new MultipartBody.Builder()
.setType(MultipartBody.FORM)
.addFormDataPart("__RequestVerificationToken", veritoken)
.addFormDataPart("Q_b9849eb2-813d-4d0a-a1ce-643f1c8af986_0", "test")
.addFormDataPart("Q_62ebd8c8-7d45-481d-a8b1-ad54a390a029_0", "[e-mail]")
.addFormDataPart("Q_f4a3bb2e-ebab-4660-a9a1-75c0d79fe0b4_0", "")
.addFormDataPart("Q_20cd46d1-3b95-46ad-81a3-b7b4d7fe7bf9_0", "b9558536-87d3-4395-aceb-ac3e012b4bad")
.addFormDataPart("Q_012d8ddf-e75a-4266-ae78-f59502862aa9_0", "Bay 4")
.addFormDataPart("Q_6b61b457-f325-41d7-9784-5cb4a959223f_0", "Superman")
.addFormDataPart("FormId", "276caa59-80a5-4ced-9b9d-025e1d753b4a")
.addFormDataPart("_ACTION", "Continue")
.addFormDataPart("PageIndex", "1")
.build();
Request request = new Request.Builder()
.addheader("X-Requested-With", "XMLHttpRequest")
.addheader("Host", host)
.addheader("Origin", origin)
.addheader("Referer", url)
.addheader("__RequestVerificationToken", veritoken)

.url(url)
.post(requestBody)
.build();

Python代码运行良好，Java代码则不然。

Answer 1

看起来您在python代码中使用了具有cookie持久性的请求python库。然而，Java代码中的发布请求似乎没有附加CSRF cookie令牌。您需要通过发出获取请求来获取cookie，然后在发出发布请求时添加cookie。我将在下面展示一个使用Jsoup的示例。

Connection.Response r = Jsoup.connect(url).method(Connection.Method.GET).execute();
Map co = r.cookies();
Jsoup.connect(url).cookies(co).header(veriTokenKey, veritoken).data(veriTokenKey, veritoken).method(Connection.Method.POST).execute();