0

Please help someone, i am trying to save spring session id in relation database from here link

And i am getting this error:

Whitelabel Error Page

This application has no explicit mapping for /error, so you are seeing this as a fallback. Thu Jan 28 19:51:15 IST 2016 There was an unexpected error (type=Forbidden, status=403). Expected CSRF token not found. Has your session expired?

And my SecurityConfig class:

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
//@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
@EnableWebSecurity
public class SecurityConfig {


    @Bean
    public HttpSessionStrategy httpSessionStrategy() {
        return new CookieHttpSessionStrategy();
    }

    @Bean
    public SessionRepositoryFilter<ExpiringSession> sessionRepositoryFilter(
            SessionRepository<ExpiringSession> sessionRepository,
            HttpSessionStrategy httpSessionStrategy
    ) {
        SessionRepositoryFilter<ExpiringSession> sessionRepositoryFilter = new SessionRepositoryFilter<>(sessionRepository);
        sessionRepositoryFilter.setHttpSessionStrategy(httpSessionStrategy);
        return sessionRepositoryFilter;
    }

    @Bean
    public SessionRepository<ExpiringSession> sessionRepository() {
        return new JPASessionRepository(10);
    }



    @Configuration
    @Order(1)
    public static class SpringWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
        @Bean
        public AuthenticationManager authenticationManager() throws Exception {
            return super.authenticationManager();
        }

        @Autowired
        private UserDetailsService userDetailsService;

        @Autowired
        private SessionRepositoryFilter<ExpiringSession> sessionSessionRepositoryFilter;

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.authorizeRequests()
                    .antMatchers("/public/**").permitAll()
                    .antMatchers(("/")).hasAnyAuthority("ADMIN")
                    .antMatchers("/home").hasAnyAuthority("ADMIN")
                    .antMatchers("/users/**").hasAuthority("ADMIN")
                    .anyRequest().fullyAuthenticated()
                    .and()
                    .formLogin()
                    .loginPage("/login")
                    .defaultSuccessUrl("/adduser")
                    .failureUrl("/login?error")
                    .usernameParameter("email")
                    .passwordParameter("password")
                    .permitAll()
                    .and()
                    .addFilterBefore(sessionSessionRepositoryFilter, ChannelProcessingFilter.class)
                    .logout()
                    .logoutUrl("/logout")
                    .deleteCookies("remember-me")
                    .logoutSuccessUrl("/home")
                    .permitAll()
                    .and()
                    .rememberMe();
        }

        @Override
        public void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth
                    .userDetailsService(userDetailsService)
                    .passwordEncoder(new BCryptPasswordEncoder());
        }
    }
}
sKhan
  • 9,694
  • 16
  • 55
  • 53
Ravi H
  • 596
  • 3
  • 23
  • Have you configured /error page in your project? what error are you seeing in log file? – Pankaj Pandey Jan 28 '16 at 14:46
  • I haven't set log file in my project, but i can see logs in my idea(intellij) console. In my case i am not seeing any error in idea console. – Ravi H Jan 28 '16 at 14:56
  • The above error is showing you don't have /error to mapping any resource in your project.Could you paste your stacktrace here. – Pankaj Pandey Jan 28 '16 at 14:58
  • after login i am getting this error page, and session id saving in database. – Ravi H Jan 28 '16 at 15:04
  • And also i am seeing JSESSION and SESSION in browser – Ravi H Jan 28 '16 at 15:05
  • The 403 indicates no access, and apparently you have enabled CSRF protection and aren't sending the token. – M. Deinum Jan 28 '16 at 15:17
  • See http://stackoverflow.com/questions/28138864/expected-csrf-token-not-found-has-your-session-expired-403 for options other than disabling CSRF. (sorry, I don't have the rep to vote to close it as a duplicate) – paloma Jan 29 '16 at 17:26

0 Answers0