dwr安全错误

http://hi.baidu.com/fququ/blog/item/586437a4979e4ff29052ee95.html
DWR 2.0 ajax 使用总结
从网上查了N多资料也没把dwr 配置成功.以下是从失败中成功总结出来的可应用的dwr2.0 使

1,dwr.xml文件:

<!DOCTYPE dwr PUBLIC
    "-//GetAhead Limited//DTD Direct Web Remoting 1.0//EN"
    "http://www.getahead.ltd.uk/dwr/dwr10.dtd">

<dwr>
<allow>
   <create creator="new" javascript="BLACK_LIST">
    <param name="class" value="com.hzsoft.mcms.system.BLACK_LIST"/>
   </create>
   <create creator="new" javascript="SYS_MODEL_BASE">
    <param name="class" value="com.hzsoft.mcms.bean.SYS_MODEL_BASE"/>
   </create>
</allow>
</dwr>


2,web.xml文件添加servlet:
<servlet>
      <servlet-name>dwr-invoker</servlet-name>
      <servlet-class>org.directwebremoting.servlet.DwrServlet</servlet-class>
      <init-param>
          <param-name>debug</param-name>
           <param-value>true</param-value>
      </init-param>
      <init-param>
    <param-name>classes</param-name>

    <param-value>java.lang.Object</param-value>
   </init-param>

<load-on-startup>100</load-on-startup>
</servlet>

<servlet-mapping>
      <servlet-name>dwr-invoker</servlet-name>
      <url-pattern>/dwr/*</url-pattern>
</servlet-mapping>
红色部分是需要注意与1.0等不同的地方

3,使用时dwr路径问题:
<script type='text/javascript' src='../dwr/interface/SYS_MODEL_BASE.js'></script>
<script type='text/javascript' src='../dwr/engine.js'></script>
<script type='text/javascript' src='../dwr/util.js'></script>
这里需要注意用的是相对于网站跟目录的使用位置

4,用winrar打开dwr.jar包还是源码包我忘记了，把commons-logging-1.0.4.jar　放到工程lib 目录下

5,别忘了添加dwr.jar 包，2.03版的是约489 k大小(偏差２k)

6,写完你的后台代码后输入 http://localhost:8080/myproject/dwr/　看看是否有可引用的函数，有就引用成功．没有的话那说明配置还是有问题．


-----------------------------------------------------
http://darkmasky.iteye.com/blog/464669

错误描述:

org.directwebremoting.dwrp.BaseDwrpHandler - A request has been denied as a potential CSRF attack.
org.directwebremoting.dwrp.BaseCallHandler - Exception while processing batch
java.lang.SecurityException: CSRF Security Error

  at org.directwebremoting.dwrp.BaseDwrpHandler.checkNotCsrfAttack(BaseDwrpHandler.java:85)
  at org.directwebremoting.dwrp.BaseCallHandler.handle(BaseCallHandler.java:76)
  at org.directwebremoting.servlet.UrlProcessor.handle(UrlProcessor.java:120)
  at org.directwebremoting.servlet.DwrServlet.doPost(DwrServlet.java:141)
  at javax.servlet.http.HttpServlet.service(HttpServlet.java:710)
  at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
  at org.apache.struts2.dispatcher.ActionContextCleanUp.doFilter(ActionContextCleanUp.java:99)
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
  at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:230)
  at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
  at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
  at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:104)
  at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
  at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:261)
  at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)
  at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process  (Http11Protocol.java:581)
  at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
  at java.lang.Thread.run(Thread.java:619)



解决办法:

修改 web.xml 中 DWR 配置信息

原:

<servlet> 
      <servlet-name>dwr-invoker</servlet-name> 
     <servlet-class>org.directwebremoting.spring.DwrSpringServlet</servlet-class> 
     <init-param>
      <param-name>debug</param-name>
      <param-value>true</param-value>
  </init-param>
</servlet>



加入跨域调用配置信息(红色部分)，修改为:

<servlet> 
      <servlet-name>dwr-invoker</servlet-name> 
      <servlet-class>org.directwebremoting.spring.DwrSpringServlet</servlet-class> 
      <init-param>
             <param-name>debug</param-name>
             <param-value>true</param-value>
      </init-param>
      <init-param>
             <param-name>crossDomainSessionSecurity</param-name>
             <param-value>false</param-value>
      </init-param>
      <init-param>
            <param-name>allowScriptTagRemoting</param-name>
            <param-value>true</param-value>
      </init-param>
</servlet>