0Pricing
Spring Security 6 & JWT Authentication · 课时

常见安全漏洞与修复方案

在 Spring Security 环境中识别并处理常见的 Web 应用安全漏洞，例如 XSS、CSRF 和 SQL 注入。

常见安全漏洞与修复方案 是 CoddyKit 上的免费 Spring Security 6 & JWT Authentication 课时。 这是第 3 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 Spring Security 6 & JWT Authentication 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Spring Security 6 & JWT Authentication 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

Web Vulnerabilities Overview

Welcome! In this lesson, we'll dive into common web application security vulnerabilities. Understanding these threats is crucial for building robust and secure applications.

Even with frameworks like Spring Security, knowing how common attacks work helps you write safer code and configure your app effectively.

What is Cross-Site Scripting?

Cross-Site Scripting (XSS) occurs when attackers inject malicious scripts (usually JavaScript) into web pages viewed by other users.

These scripts can steal session cookies, deface websites, or redirect users to phishing sites. It tricks the user's browser into executing untrusted code.

Reflected, Stored, and DOM XSS

XSS comes in a few flavors:

  • Reflected XSS: Malicious script is part of the request (e.g., URL parameter) and immediately 'reflected' back in the response.
  • Stored XSS: Malicious script is permanently stored on the target server (e.g., in a database via a comment field) and served to all visitors.
  • DOM-based XSS: The vulnerability lies in client-side code modifying the Document Object Model (DOM) based on user input, rather than server-side generation.

XSS Prevention: Input & Output

The best defenses against XSS are:

  • Input Validation: On the server, strictly validate and sanitize all user input. Don't trust anything coming from the client.
  • Output Encoding: Before displaying user-supplied data in HTML, always 'escape' it. This turns malicious code into harmless text, preventing the browser from executing it.

Spring frameworks often provide utilities for output encoding.

Encoding User Input

Here's a simple Java example demonstrating output encoding. Notice how special HTML characters like < and > are converted to their entity equivalents (&lt;, &gt;).

This makes the script harmless when rendered in a browser.

import org.springframework.web.util.HtmlUtils;

public class XssPrevention {
  public static void main(String[] args) {
    String userInput = "<script>alert('You are hacked!');</script>";
    String safeOutput = HtmlUtils.htmlEscape(userInput);

    System.out.println("Original: " + userInput);
    System.out.println("Encoded: " + safeOutput);
  }
}

What is Cross-Site Request Forgery?

Cross-Site Request Forgery (CSRF) is an attack that tricks a logged-in user into submitting a request they did not intend. For example, changing their password or making a purchase.

The attacker crafts a malicious web page that sends a request to your application, and if the user is logged in, their browser automatically includes authentication credentials (like cookies).

Spring Security's CSRF Defense

Spring Security provides robust, built-in CSRF protection. By default, it generates a unique, synchronized token (a CSRF token) for each session.

This token must be included in non-GET requests (like POST, PUT, DELETE). If the token is missing or invalid, Spring Security rejects the request, preventing CSRF attacks.

What is SQL Injection?

SQL Injection (SQLi) is a common attack where malicious SQL code is inserted into input fields to manipulate backend database queries.

Attackers can use SQLi to bypass authentication, retrieve sensitive data, modify data, or even take control of the database server. It's often exploited when an application constructs SQL queries using concatenated strings.

SQLi Prevention: Parameterized Queries

The primary defense against SQL Injection is using parameterized queries (also known as prepared statements).

Instead of concatenating user input directly into the SQL string, placeholders are used. The database then treats user input as data, not as executable SQL code, neutralizing the attack.

import java.sql.*;

public class SqlInjectionPrevention {
  public static void main(String[] args) {
    String username = "admin' OR '1'='1"; // Malicious input

    // GOOD: Parameterized Query (Safe concept)
    String goodSql = "SELECT * FROM users WHERE username = ?";
    System.out.println("Safe SQL (PreparedStatement concept): " + goodSql);
    System.out.println("Parameter used: " + username);
    // In a real app, 'username' would be set as a parameter
    // on a PreparedStatement object.
  }
}

Vulnerability Check

Which of the following is the most effective way to prevent SQL Injection attacks?

Lesson Summary

Great job! You've explored three critical web vulnerabilities and their fixes:

  • XSS: Prevent with input validation and output encoding.
  • CSRF: Spring Security handles this by default with CSRF tokens.
  • SQL Injection: Prevent with parameterized queries (prepared statements).

Always remember to validate all input, encode all output, and leverage your framework's built-in security features!

常见问题解答

「常见安全漏洞与修复方案」课时是免费的吗？

是的 — 「常见安全漏洞与修复方案」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Spring Security 6 & JWT Authentication 课程的其余内容，请升级到 CoddyKit PRO。 Spring Security 6 & JWT Authentication 课程共包含 4 节课。

「常见安全漏洞与修复方案」这节课中我会学到什么？

在 Spring Security 环境中识别并处理常见的 Web 应用安全漏洞，例如 XSS、CSRF 和 SQL 注入。 你通过在浏览器中直接运行的动手代码来练习 Spring Security 6 & JWT Authentication，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Spring Security 6 & JWT Authentication 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Spring Security 6 & JWT Authentication 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 3 节课，共 4 节。

「常见安全漏洞与修复方案」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Spring Security 6 & JWT Authentication 课中编写并运行代码吗？

能。每节 Spring Security 6 & JWT Authentication 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

  1. 生产环境安全加固
  2. 安全事件日志记录与监控
  3. 常见安全漏洞与修复方案
  4. 配置安全标头与 HTTPS
← 返回 Spring Security 6 & JWT Authentication