CODEWITHSUNDEEP
c#spring-boot
ncite
ncite

Reputation: 563

Spring WebSecurityConfigurerAdapter permitAll() does not allow REST POST requests from c# client?

I have this setup in my WebSecurityConfigurerAdapter to allow my client application to send POST request to the "/commands/" path on server:

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests()
            .antMatchers("/").permitAll()
            .antMatchers("/commands/**").permitAll()
            .antMatchers("/files/**").authenticated()
            .and().
            formLogin();
    }

GET requests are fine,however the csrf seems be required for POST requests after this setup. I get following result if I don't login:

{
    "timestamp": 1497904660159,
    "status": 403,
    "error": "Forbidden",
    "message": "Could not verify the provided CSRF token because your session was not found.",
    "path": "/commands/add"
}

If I login and attach the cookies from login request with C# client code, I will get following error:

{
    "timestamp":1497897646380,
    "status":403,
    "error":"Forbidden",
    "message":"Could not verify the provided CSRF token because your session was not found.",
    "path":"/commands/add"
}

My C# code client for post looks like this:

public String SendJsonCommandByPost(String url, string data)
{
    try
    {
        WebRequest req = HttpWebRequest.Create(url);
        req.Proxy = null;
        req.Method = "POST";
        req.Timeout = TIMEOUT;
        ((HttpWebRequest)req).CookieContainer = myCookieContainer;
        PrintCookies(myCookieContainer);
        req.Headers.Add("X-CSRF-TOKEN", _csrftoken);
        req.ContentType = "application/json";
        ((HttpWebRequest)req).UserAgent = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.121 Safari/535.2";
        byte[] postdata = Encoding.UTF8.GetBytes(data);
        req.ContentLength = postdata.Length;
        Stream stream = req.GetRequestStream();
        stream.Write(postdata, 0, postdata.Length);
        stream.Flush();
        stream.Close();
        string source;

        Console.WriteLine(req.Headers);
        using (HttpWebResponse response = (HttpWebResponse)req.GetResponse())
        {
            using (StreamReader reader = new StreamReader(req.GetResponse().GetResponseStream()))
            {
                source = reader.ReadToEnd();
            }

            req.GetResponse().Close();
            return source;
        }
    }
    catch (Exception exp)
    {
        Console.WriteLine(exp);
        if (exp is WebException)
        {
            var webexp = (WebException)exp;
            Console.WriteLine(webexp.Response.Headers);
            TextReader reader = new StreamReader(webexp.Response.GetResponseStream());
            Console.WriteLine(reader.ReadToEnd());
        }
        return null;
    }
}

May I know what could cause this kind of issue? Thank you!

Upvotes: 1

Views: 1543

Answers (1)

Sanga Krish
Sanga Krish

Reputation: 31

add this line.

http.csrf().disable();

By default csrf is enabled so your post requests are getting blocked. Try this. It works for me

Upvotes: 2

Related Questions