Passing JSessionId and CSRF-Token in Spring Boot for POST

Question

I have Spring Boot 2.1.0.RELEASE app. I am trying to understand login and CSRF configuration, so I first send a GET request:

 GET http://localhost:8080/devices
 Accept: application/json
 Authorization: Basic user test

Doing the same again with the JSessionID which I received, works also:

GET http://localhost:8080/devices
Accept: application/json
#Authorization: Basic user test
cookie: JSESSIONID=162A7A29081CC89EA444423D9508F286

Everything fine so far. I got 200 responses and I got a CSRF token. Latter one:

HTTP/1.1 200 
Set-Cookie: XSRF-TOKEN=2adcabdd-d804-4f13-a2a6-b95621ce868c; Path=/
....

Ok, now I want to try a POST-request directly:

POST localhost:8080/devices/check
Content-Type: application/json
#Authorization: Basic user password
cookie: JSESSIONID=162A7A29081CC89EA444423D9508F286; XSRF-TOKEN=2adcabdd-d804-4f13-a2a6-b95621ce868c
#X-XSRF-TOKEN: 2adcabdd-d804-4f13-a2a6-b95621ce868c

But independently, if I try to pass the XSRF token via Cookie or Header, I will get a 403 Forbidden.

This is my Spring Security config:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf()
                .csrfTokenRepository(CookieCsrfTokenRepository
                        .withHttpOnlyFalse()).and()
                .authorizeRequests()
                .antMatchers("/", "/home").permitAll()
                .anyRequest().authenticated()
                .and()
                .httpBasic().and()
                .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
                .logout()
                .permitAll();
    }

}

What I am doing wrong here?

Fyi: I am sendig the reqeusts with IntelliJ HTTP client.

please debug and see what is the reason for 403? It is invalid CSRF token or? — Lemmy

rweiller rweiller · Accepted Answer · 2019-08-18T18:55:50

Here's what I've done:

Retrieve your cookie from your RequestContext:

function getMyToken() {
    Cookies[] cookies = getRequestContext().getRequest().getCookies()
    for (cookie in cookies) {
        if (cookie.getName().equals("XSRF-TOKEN")) return cookie.getValue()
    }
}

Then in my form:

<input name="_csrf" value="getMyToken()"/>

It worked for me.

Passing JSessionId and CSRF-Token in Spring Boot for POST

1 Answers