Spring security - Basic auth

Question

I'm trying to insert data using a POST request but I'm getting a 403 error. When I use GET, basic authentication works. For testing I use Fiddler.

What's the problem?

Security config:

@Configuration @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() .antMatchers("/**").hasRole("USER").and() .httpBasic(); } @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth .inMemoryAuthentication() .withUser("user") .password("password") .roles("USER"); } }

Request - POST:

User-Agent: Fiddler Host: localhost:8080 Content-Length: 200 Content-Type: application/json Authorization: Basic dXNlcjpwYXNzd29yZA==

Request body:

{"name" : "name1", "description" : "desc1"}

Lifeweaver · Accepted Answer · 2019-07-03 19:11:03Z

It's probably CSRF, which spring security enables by default. Look for a X-XSRF-TOKEN header in your GET request, and use that header and value in your POST.

Think twice before you do this, but you can disable csrf with

http.csrf().disable()

https://docs.spring.io/spring-security/site/docs/current/reference/html/web-app-security.html#csrf

rgrebski · Accepted Answer · 2015-05-26 21:31:50Z

Try this:

@Configuration @EnableWebSecurity public class HelloWebSecurityConfiguration extends WebSecurityConfigurerAdapter { @Autowired public void configureGlobal(AuthenticationManagerBuilder auth) { auth .inMemoryAuthentication() .withUser("user").password("password").roles("USER"); } }

Source: http://spring.io/blog/2013/07/03/spring-security-java-config-preview-web-security/

Not too clear: are you trying to log in/insert data etc using a form and POST and its not working with SpringSecurity but GET does?

Collectives™ on Stack Overflow

Spring security - Basic auth

2 Answers 2

Comments

1 Comment

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Related