Получение ошибки «Неверный токен CSRF», даже если CSRF отключен ⇐ JAVA

[Гость]

Недавно я обновил свое приложение Spring Boot до Spring Boot 3.2 и Spring Security 6.2. Я также представил токены формата JWT для авторизации.
Я хочу отключить требование токена CSRF, поскольку я уже использую токен JWT. Но даже после его отключения в классе конфигурации безопасности, когда я делаю запрос на создание токена JWT, отправляя POST-запрос к конечной точке /oauth2/token, я получаю в ответ 401 несанкционированную ошибку.
Ниже это мой фрагмент конфигурации безопасности:

Код: Выделить всё

@Bean
AuthenticationManager authManager(HttpSecurity http) throws Exception {
AuthenticationManagerBuilder authenticationManagerBuilder = http.getSharedObject(AuthenticationManagerBuilder.class);
authenticationManagerBuilder.authenticationProvider(authenticationProvider());
authenticationManagerBuilder.eraseCredentials(false);
return authenticationManagerBuilder.build();
}

// @formatter:off
@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
OAuth2AuthorizationServerConfigurer authorizationServerConfigurer = new OAuth2AuthorizationServerConfigurer();

authorizationServerConfigurer
.tokenEndpoint(tokenEndpoint ->
tokenEndpoint
.accessTokenResponseHandler(authenticationSuccessHandler())
.accessTokenRequestConverter(new CasServiceGrantAuthenticationConverter())
.authenticationProvider(authenticationProvider()));

http.csrf(AbstractHttpConfigurer::disable)
.anonymous(AbstractHttpConfigurer::disable)
.formLogin(AbstractHttpConfigurer::disable)
.httpBasic(AbstractHttpConfigurer::disable)
.cors(cors -> cors.configurationSource(corsConfigurationSource()))
.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.authorizeHttpRequests((authorize) -> {
authorize.requestMatchers("/oauth2/token", "/error").permitAll()
.anyRequest().permitAll();
})
.authenticationProvider(authenticationProvider())
.oauth2ResourceServer((resourceServer) ->  resourceServer.jwt(Customizer.withDefaults()))
.apply(authorizationServerConfigurer);

return http.build();
}
// @formatter:on

@Bean
RegisteredClientRepository registeredClientRepository(JdbcTemplate jdbcTemplate) {
return new JdbcRegisteredClientRepository(jdbcTemplate);
}

@Bean
OAuth2AuthorizationService oAuth2AuthorizationService() {
return new InMemoryOAuth2AuthorizationService();
}

@Bean
AuthorizationServerSettings authorizationServerSettings() {
return AuthorizationServerSettings.builder().build();
}

Ниже приведен вывод журнала консоли, когда я вызываю API к конечной точке /oauth2/token:

Код: Выделить всё

[2m2024-03-13T15:35:02.621Z[0;39m [32mDEBUG[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Securing POST /oauth2/token
[2m2024-03-13T15:35:02.621Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking DisableEncodeUrlFilter (1/16)
[2m2024-03-13T15:35:02.638Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking WebAsyncManagerIntegrationFilter (2/16)
[2m2024-03-13T15:35:02.638Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking SecurityContextHolderFilter (3/16)
[2m2024-03-13T15:35:02.646Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking HeaderWriterFilter (4/16)
[2m2024-03-13T15:35:02.646Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking CorsFilter (5/16)
[2m2024-03-13T15:35:02.646Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking CsrfFilter (6/16)
[2m2024-03-13T15:35:02.669Z[0;39m [32mDEBUG[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.csrf.CsrfFilter        [0;39m [2m:[0;39m Invalid CSRF token found for http://localhost:9091/oauth2/token
[2m2024-03-13T15:35:02.669Z[0;39m [32mDEBUG[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.s.w.access.AccessDeniedHandlerImpl  [0;39m [2m:[0;39m Responding with 403 status code
[2m2024-03-13T15:35:02.677Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.s.w.header.writers.HstsHeaderWriter [0;39m [2m:[0;39m Not injecting HSTS header since it did not match request to [Is Secure]
[2m2024-03-13T15:35:02.694Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Trying to match request against DefaultSecurityFilterChain [RequestMatcher=any request, Filters=[org.springframework.security.web.session.DisableEncodeUrlFilter@5d33742, org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@7cf3544, org.springframework.security.web.context.SecurityContextHolderFilter@792841ab, org.springframework.security.web.header.HeaderWriterFilter@70841eba, org.springframework.web.filter.CorsFilter@4087fff9, org.springframework.security.web.csrf.CsrfFilter@328dce25, org.springframework.security.web.authentication.logout.LogoutFilter@11fb5c55, org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@37539d92, org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter@42cb71f9, org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter@266737c4, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@6aa4b9ae, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@32975a20, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@266713d4, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@3a126d6d, org.springframework.security.web.access.ExceptionTranslationFilter@5c33a1b3,  org.springframework.security.web.access.intercept.AuthorizationFilter@16b59ac4]] (1/1)
[2m2024-03-13T15:35:02.694Z[0;39m [32mDEBUG[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Securing POST /error
[2m2024-03-13T15:35:02.694Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking DisableEncodeUrlFilter (1/16)
[2m2024-03-13T15:35:02.694Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking WebAsyncManagerIntegrationFilter (2/16)
[2m2024-03-13T15:35:02.694Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking SecurityContextHolderFilter (3/16)
[2m2024-03-13T15:35:02.694Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking HeaderWriterFilter (4/16)
[2m2024-03-13T15:35:02.694Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking CorsFilter (5/16)
[2m2024-03-13T15:35:02.694Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking CsrfFilter (6/16)
[2m2024-03-13T15:35:02.694Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking LogoutFilter (7/16)
[2m2024-03-13T15:35:02.696Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.s.w.a.logout.LogoutFilter           [0;39m [2m:[0;39m Did not match request to Ant [pattern='/logout', POST]
[2m2024-03-13T15:35:02.696Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking UsernamePasswordAuthenticationFilter (8/16)
[2m2024-03-13T15:35:02.696Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mw.a.UsernamePasswordAuthenticationFilter[0;39m [2m:[0;39m Did not match request to Ant [pattern='/login', POST]
[2m2024-03-13T15:35:02.696Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking DefaultLoginPageGeneratingFilter (9/16)
[2m2024-03-13T15:35:02.696Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking DefaultLogoutPageGeneratingFilter (10/16)
[2m2024-03-13T15:35:02.696Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking BasicAuthenticationFilter (11/16)
[2m2024-03-13T15:35:02.696Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking RequestCacheAwareFilter (12/16)
[2m2024-03-13T15:35:02.696Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.s.w.s.HttpSessionRequestCache       [0;39m [2m:[0;39m matchingRequestParameterName is required for getMatchingRequest to lookup a value,  but not provided
[2m2024-03-13T15:35:02.696Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking SecurityContextHolderAwareRequestFilter (13/16)
[2m2024-03-13T15:35:02.696Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking AnonymousAuthenticationFilter (14/16)
[2m2024-03-13T15:35:02.696Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking ExceptionTranslationFilter (15/16)
[2m2024-03-13T15:35:02.701Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.security.web.FilterChainProxy       [0;39m [2m:[0;39m Invoking AuthorizationFilter (16/16)
[2m2024-03-13T15:35:02.701Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mestMatcherDelegatingAuthorizationManager[0;39m [2m:[0;39m Authorizing SecurityContextHolderAwareRequestWrapper[ FirewalledRequest[ org.apache.catalina.core.ApplicationHttpRequest@54878cee]]
[2m2024-03-13T15:35:02.710Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mestMatcherDelegatingAuthorizationManager[0;39m [2m:[0;39m Checking authorization on SecurityContextHolderAwareRequestWrapper[ FirewalledRequest[ org.apache.catalina.core.ApplicationHttpRequest@54878cee]] using org.springframework.security.authorization.AuthenticatedAuthorizationManager@1129e8d0
[2m2024-03-13T15:35:02.710Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mw.c.HttpSessionSecurityContextRepository[0;39m [2m:[0;39m Did not find SecurityContext in HttpSession A55AA532047F0432CEFA487835EDE24C using the SPRING_SECURITY_CONTEXT session attribute
[2m2024-03-13T15:35:02.710Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36m.s.s.w.c.SupplierDeferredSecurityContext[0;39m [2m:[0;39m Created SecurityContextImpl [Null authentication]
[2m2024-03-13T15:35:02.710Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36m.s.s.w.c.SupplierDeferredSecurityContext[0;39m [2m:[0;39m Created SecurityContextImpl [Null authentication]
[2m2024-03-13T15:35:02.713Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.s.w.a.AnonymousAuthenticationFilter [0;39m [2m:[0;39m Set SecurityContextHolder to AnonymousAuthenticationToken [Principal=anonymousUser, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=0:0:0:0:0:0:0:1, SessionId=A55AA532047F0432CEFA487835EDE24C], Granted Authorities=[ROLE_ANONYMOUS]]
[2m2024-03-13T15:35:02.717Z[0;39m [32mTRACE[0;39m [35m22908[0;39m [2m---[0;39m [2m[ttoyou-api-gateway-service] [nio-9091-exec-1][0;39m [2m[0;39m[36mo.s.s.w.a.ExceptionTranslationFilter    [0;39m [2m:[0;39m Sending AnonymousAuthenticationToken [Principal=anonymousUser, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=0:0:0:0:0:0:0:1, SessionId=A55AA532047F0432CEFA487835EDE24C], Granted Authorities=[ROLE_ANONYMOUS]] to authentication entry point since access is denied

org.springframework.security.access.AccessDeniedException: Access Denied
at org.springframework.security.web.access.intercept.AuthorizationFilter.doFilter(AuthorizationFilter.java:98) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.ObservationFilterChainDecorator$ObservationFilter.wrapFilter(ObservationFilterChainDecorator.java:240) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.ObservationFilterChainDecorator$ObservationFilter.doFilter(ObservationFilterChainDecorator.java:227) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.ObservationFilterChainDecorator$VirtualFilterChain.doFilter(ObservationFilterChainDecorator.java:137) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:126) ~[spring-security-web-6.2.2.jar:6.2.2]
...

From above console log it appears that CsrfFilter is getting invoked due to which it gives 403 status code in response.
Can you help me identify what can be the solution to this issue? I am trying since 3-4 days and tried many ways to debug and identify the issue. Thanks


Источник: https://stackoverflow.com/questions/781 ... s-disabled