0

I call a HTTP post method first time, I catch an MissingCsrfTokenException because session is null, so I add bellow line to configuration

.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.ALWAYS)

after the change, I try again but at the http method calling I catch org.springframework.security.web.csrf.InvalidCsrfTokenException: Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-CSRF-TOKEN'. (Csrf protection is Disabled as below)

@Override
protected void configure(HttpSecurity http) 
    throws Exception {
    http
            .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.ALWAYS)
            .and()
            .authorizeRequests()
            .antMatchers(public_path)
            .permitAll()
            .anyRequest()
            .hasAnyRole(required_role_for_all_request)
            .and()
            .httpBasic().disable()
            .csrf().disable()
            .logout().logoutUrl(logout_url)
            .logoutSuccessHandler(this.customLogoutSuccessHandler)
            .addLogoutHandler(this.customLogoutHandler)
            .and().exceptionHandling()
            .accessDeniedHandler(this.customAccessDeniedExceptionHandler);

    if (!properties.getCorsRequired()) {
        http.cors().configurationSource(corsConfigurationSource());
    }
    super.configure(http);
}

I noticed that it only happens on HTTP POST method calling

Mohammad Sadegh Rafiei
  • 486
  • 1
  • 5
  • 14
  • First, I'm curious why you are disabling CSRF? Second, I wonder if you have tried removing the other configurations to simplify your analysis, e.g. `http.csrf.disable(); super.configure(http);` - please consider posting a minimal sample that reproduces the issue. – jzheaux Dec 15 '20 at 22:05
  • I solved it, write super.configure(http); at the first of line of method. – Mohammad Sadegh Rafiei Dec 16 '20 at 14:54
  • Glad you found a solution. As a side note, take caution when disabling CSRF as it's usually important to leave enabled. – jzheaux Dec 18 '20 at 15:55

0 Answers0