My Security Configuration in Spring:
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.cors()
.and()
.authorizeRequests()
.antMatchers("/user/save")
.permitAll()
.and()
.authorizeRequests()
.antMatchers("/user/**")
.hasRole("USER")
.and()
.httpBasic()
.and()
.logout()
.clearAuthentication(true)
.invalidateHttpSession(true)
.deleteCookies("JSESSIONID")
.deleteCookies("XSRF-TOKEN")
.permitAll()
.and()
.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
}
I am using Angular 6 on the front-end. I am doing a POST on the endpoint /logout
. I can see the JSESSIONID
and the XSRF
cookies being sent on the request (using the developer tools in Chrome).
However, on the console of the Spring Server Side Application I get the following stack-trace:
Invalid CSRF token found for http://localhost:8009/logout
...and the logout request fails.
I cannot understand why the XSRF token is not being updated (if that is so), or why the token is invalid. Any help is appreciated.