Spring 安全性 XML 错误 - cvc-complex-type.2.4.a：发现以元素"csrf"开头的无效内容

Question

我在web应用程序项目中使用Spring Security。我想在我的Spring应用程序中启用csrf保护。我的application-context-security.xml如下

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
                         http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                        http://www.springframework.org/schema/security
                         http://www.springframework.org/schema/security/spring-security-3.0.xsd">
    <global-method-security secured-annotations="enabled"/> 
    <http disable-url-rewriting="true" auto-config="false" access-decision-manager-ref="accessDecisionManager" entry-point-ref="authenticationEntryPoint">
        <intercept-url pattern="/" access="IS_AUTHENTICATED_ANONYMOUSLY, IS_AUTHENTICATED_FULLY, IS_AUTHENTICATED_REMEMBERED"/>
        <intercept-url pattern="/j_spring_security_check" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
        <intercept-url pattern="/j_spring_security_logout" access="IS_AUTHENTICATED_ANONYMOUSLY, IS_AUTHENTICATED_FULLY, IS_AUTHENTICATED_REMEMBERED"/>
<!-- Enable CSRF protection -->
        <csrf />
    <access-denied-handler ref="accessDeniedHandler"/>         
    </http>
<!-- Remaining information -->
</beans:beans>

我的项目使用的是Spring 3.0.5 jar。

运行时，我得到以下错误

SEVERE: Exception sending context initialized event to listener 
instance of class org.springframework.web.context.ContextLoaderListener
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException:
 nested exception is org.xml.sax.SAXParseException: cvc-complex-type.2.4.a: 
Invalid content was found starting with element 'csrf'. 
One of 
'{"http://www.springframework.org/schema/security":intercept-url,
 "http://www.springframework.org/schema/security":access-denied-handler, 
"http://www.springframework.org/schema/security":form-login, 
"http://www.springframework.org/schema/security":openid-login, 
"http://www.springframework.org/schema/security":x509, 
"http://www.springframework.org/schema/security":http-basic, 
"http://www.springframework.org/schema/security":logout, 
"http://www.springframework.org/schema/security":session-management, 
"http://www.springframework.org/schema/security":remember-me, 
"http://www.springframework.org/schema/security":anonymous, 
"http://www.springframework.org/schema/security":port-mappings, 
"http://www.springframework.org/schema/security":custom-filter, 
"http://www.springframework.org/schema/security":request-cache}' 
is expected.

我试着在谷歌上搜索这个错误。我发现了几个类似的地方，但他们都说错误是由于Spring3.2+中的一些更改造成的。然而，在我的情况下，我使用的是Spring3.0.5。

如有任何帮助，我们将不胜感激。

Answer 1

从
更新后出现相同错误弹簧3.2.5至4.2.0
弹簧安全3.1.4至4.0.2

我不得不从
更改架构位置http://www.springframework.org/schema/security/spring-security.xsd
至
http://www.springframework.org/schema/security/spring-security-4.0.xsd

<beans xmlns="http://www.springframework.org/schema/beans" xmlns:sec="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:osgi="http://www.springframework.org/schema/osgi" xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
          http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.0.xsd
          http://www.springframework.org/schema/osgi http://www.springframework.org/schema/osgi/spring-osgi.xsd
          http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">

在您的情况下，<csrf>元素在spring3.0.5中不存在。
因此，至少更新到3.2是解决方案。

Answer 2

我认为spring-security的csrf快捷方式是在3.2.0版本中引入的（请参阅博客文章）

也许您应该考虑更新您使用的春季版本