Spring Security CSRF Disable Not working

Question

I have an application which uses Spring Security for Authentication. Earlier we were using spring security 3.2.10 and now trying to upgrade to 4.2.6. In spring 4 onwards, CSRF protection is enabled by default.

I am following the migration guide - https://docs.spring.io/spring-security/site/migrate/current/3-to-4/html5/migrate-3-to-4-xml.html

When I just changed the namespace and replaced security jars and tried to login from the login page, it gave 404 error for "/j_spring_security_check".

As per the Guide, I changed the form login action to "/login" instead of "/j_spring_security_check". Also changed the username and password parameters to "username" and "password" instead of "j_username" and "j_password" defined in the login page.

 <form action="/login" method="POST">

After these changes I am getting CSRF token related error with 403 status code-

 Type Status Report
 Message Could not verify the provided CSRF token because your session was 
 not found.
 Description The server understood the request but refuses to authorize it.

I disabled the CSRF protection by adding below in spring security config file -

  <security:http disable-url-rewriting="true" use-expressions="true">
    <security:csrf disabled="true"/>
    ..
    <security:intercept-url pattern="/login.jsp" 
    access="hasRole('ROLE_ANONYMOUS')"/>
    <security:form-login login-page="/login.jsp"
                         authentication-failure-url="/login.jsp? 
                         login_error=1"
                         default-target-url="/index.html" authentication- 
             success-handler-ref="successHandler" always-use-default- 
    target="true"/>
    <security:logout logout-success-url="/login.jsp"/>

But still this is not working and giving me CSRF related error with 403 status -

 Type Status Report
 Message Could not verify the provided CSRF token because your session was 
 not found.
 Description The server understood the request but refuses to authorize it.

Is there anything I am missing ?

try omit security: part. Do only this: <csrf disabled="true"/>. If this doesn't work, show me your namespaces please — ISlimani
– ISlimani, Commented Jul 4, 2018 at 6:23
It didnt work. My namespace looks like this <beans xmlns="springframework.org/schema/beans" xmlns:xsi="w3.org/2001/XMLSchema-instance" xmlns:security="springframework.org/schema/security" xsi:schemaLocation= "springframework.org/schema/beans springframework.org/schema/beans/spring-beans-4.2.xsd springframework.org/schema/security springframework.org/schema/security/spring-security-4.2.xsd"> — Rahul Vedpathak
– Rahul Vedpathak, Commented Jul 4, 2018 at 7:07
I tried to run APIs which will not modify state of resources like GET. These are working fine. But while login into the application, it fires POST api. These api's are failing. — Rahul Vedpathak
– Rahul Vedpathak, Commented Jul 4, 2018 at 7:25

Rahul Vedpathak · Accepted Answer · 2018-07-04 10:07:14Z

1

I finally found the issue. Actually in our application A we have a list of URI's that can be handled by this application B else it forwards the request it to a different application.

So earlier "j_spring_security_check" was in that list. But I missed to add "/login" in that list.

On that application B, CSRF was not disabled hence it was causing the issue.

answered Jul 4, 2018 at 10:07

Rahul Vedpathak

1,4463 gold badges17 silver badges34 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Spring Security CSRF Disable Not working

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related