Post permit all don't took in consideration

Question

I use spring security, I try to allow a post without need to be connected.

So in a class who extends WebSecurityConfigurerAdapter

@Override
public void configure(HttpSecurity httpSecurity) throws Exception {
    httpSecurity.authorizeRequests()
            .antMatchers(
                    "/",
                    "/help**",
                    "/css/**",
                    "/js/**",
                    "/img/**").permitAll()
            .antMatchers(HttpMethod.POST, "/printdownload**").permitAll()
            .anyRequest().authenticated()
            .and()
            .formLogin().loginPage("/login").permitAll()
            .successHandler(customAuthenticationSuccessHandler)
            .and()
            .logout();
}

When I try to call this controller

@PostMapping("/printdownload")
public String printTestament(@RequestBody TestamentWizard testamentDocuement){
   ...
}

I get this

 o.s.security.web.FilterChainProxy        : Securing POST /printdownload
 s.s.w.c.SecurityContextPersistenceFilter : Set SecurityContextHolder to empty SecurityContext
 o.s.security.web.csrf.CsrfFilter         : Invalid CSRF token found for http://localhost:8080/printdownload
 o.s.s.w.access.AccessDeniedHandlerImpl   : Responding with 403 status code
 w.c.HttpSessionSecurityContextRepository : Did not store empty SecurityContext
 w.c.HttpSessionSecurityContextRepository : Did not store empty SecurityContext
 s.s.w.c.SecurityContextPersistenceFilter : Cleared SecurityContextHolder to complete request
 o.s.security.web.FilterChainProxy        : Securing POST /error
 s.s.w.c.SecurityContextPersistenceFilter : Set SecurityContextHolder to empty SecurityContext
 o.s.s.w.a.AnonymousAuthenticationFilter  : Set SecurityContextHolder to anonymous SecurityContext
 o.s.s.w.a.i.FilterSecurityInterceptor    : Failed to authorize filter invocation [POST /error] with attributes [authenticated]
 o.s.s.web.DefaultRedirectStrategy        : Redirecting to http://localhost:8080/login
 w.c.HttpSessionSecurityContextRepository : Did not store empty SecurityContext
 w.c.HttpSessionSecurityContextRepository : Did not store empty SecurityContext
 s.s.w.c.SecurityContextPersistenceFilter : Cleared SecurityContextHolder to complete request
 o.s.security.web.FilterChainProxy        : Securing GET /login
 s.s.w.c.SecurityContextPersistenceFilter : Set SecurityContextHolder to empty SecurityContext
 o.s.s.w.a.AnonymousAuthenticationFilter  : Set SecurityContextHolder to anonymous SecurityContext
 o.s.s.w.a.i.FilterSecurityInterceptor    : Authorized filter invocation [GET /login] with attributes [permitAll]
 o.s.security.web.FilterChainProxy        : Secured GET /login
 w.c.HttpSessionSecurityContextRepository : Did not store anonymous SecurityContext
 w.c.HttpSessionSecurityContextRepository : Did not store anonymous SecurityContext
 s.s.w.c.SecurityContextPersistenceFilter : Cleared SecurityContextHolder to complete request

Just don't understand why post is secured when i specified to permit it

Does this answer your question? [spring security 403 error](https://stackoverflow.com/questions/19468209/spring-security-403-error) — dur, May 06 '22 at 09:04

score 2 · Answer 1 · answered May 06 '22 at 04:55

Spring Security secures requests through defense in depth. Because of this, access rules like permitAll() and authenticated() are not the only thing protecting the web application.

In your case, CSRF protection is rejecting the request because it is enabled by default along with other protection against exploits. You can read about CSRF protection and why POST requests require a CSRF token in the reference docs.

Post permit all don't took in consideration

1 Answers1

Linked