Chapter 27

mistre83 · September 21st, 2015, 12:11 PM

At page 776, is described:

Quote:

Only requests ignored and excluded from the chain (for
example, in configure(WebSecurity)) are unprotected. However, this is not always desirable
for all secured URLs. In the Customer Support application, for example, you should not include
CSRF protection on the RESTful and SOAP web services because they don’t use web forms

This should be done from this piece of code:

Quote:

.requireCsrfProtectionMatcher((r) -> {
String m = r.getMethod();
return !r.getServletPath().startsWith("/services/") &&
("POST".equals(m) || "PUT".equals(m) ||
"DELETE".equals(m) || "PATCH".equals(m));
});

But, when i try to make a POST request (Using Advanced Rest Client) it first make a POST requesto to /services/Rest and after it, it make a request via GET to /login , and this REST call reply with the form (that is wrong, because WebServices dont use forms).

If i make a requesto with OPTIONS type, the request is ok, because first make OPTIONS to services/Rest and later an OPTIONS to /login.

why if i use a POST, this make POST and after GET /login ?

Is something wrong in this code? I've tried to import the entire project in eclipse (as i have downloaded from the site), and i've noticed this Behaviour

beamerblvd · January 12th, 2016, 11:56 AM

Hmmm. I do not experience this issue. Have you solved it yet? If not, I would recommend placing some debug breakpoints and stepping through the code to see if you can figure out what's going on. It's going to be hard for me to track down the problem when I can't replicate it...

mistre83 · January 12th, 2016, 12:07 PM

In SecurityConfiguration.java i've changed the method:

Code:

protected void configure(HttpSecurity security)...

From:

Code:

security
                .authorizeRequests()
                    .antMatchers("/session/list")
                        .hasAuthority("VIEW_USER_SESSIONS")
                    .anyRequest().authenticated()

To:

Code:

 security
         .authorizeRequests()
         	.antMatchers("/services/**").permitAll()
             .antMatchers("/session/list")
                 .hasAuthority("VIEW_USER_SESSIONS")
             .anyRequest().authenticated()

I've added a permitAll() on /services/**