I have two spring web applications secured with spring security. These two applications communicate with each other through spring httpInovoker. Access controlling is working fine. But when I enable <csrf/>
in spring security under <http auto-config="true">
tag httpinvoker return 403 status . Stacktrace is given below. But the same code is running successfully without csrf protection. Please help
org.springframework.remoting.RemoteAccessException: Could not access HTTP invoker remote service at [http://172.28.1.162:6060/ReporterRepository/ExposedLinkService.http]; nested exception is java.io.IOException: Did not receive successful HTTP response: status code = 403, status message = [Forbidden]
Spring security xml:
<http auto-config="true">
<intercept-url pattern="/home**" access="ROLE_ADMIN,ROLE_USER" />
<intercept-url pattern="/admin**" access="ROLE_ADMIN" />
<form-login
login-page="/loginuser"
default-target-url="/home"
authentication-failure-url="/loginuser?error"
username-parameter="username"
password-parameter="password" />
<logout logout-success-url="/loginuser?logout" />
<!-- enable csrf protection -->
<csrf/>
</http>
<authentication-manager erase-credentials="false">
<authentication-provider user-service-ref="myUserDetailsService" >
</authentication-provider>
</authentication-manager>
Invoking Code:
HttpInvokerProxyFactoryBean HttpinvokerFactory = new HttpInvokerProxyFactoryBean();
HttpinvokerFactory.setServiceInterface(ExposedLinkServiceInterface.class);
HttpinvokerFactory.setServiceUrl(ServiceUrl);
HttpinvokerFactory.setHttpInvokerRequestExecutor(( HttpInvokerRequestExecutor)ServerFramework.getInstance().getBean("httpInvokerRequestExecutor"));//Return the bean httpInvokerRequestExecutor
HttpinvokerFactory.afterPropertiesSet();
ExposedLinkServiceInterface exposedservice = (ExposedLinkServiceInterface) HttpinvokerFactory.getObject();
List AvailabaleLinks= exposedservice.retrieveAllLinks();
The key here I think is to create a separate configuration for HttpInvoker URL(s):
<http pattern="/your-httpinvoker-path" create-session="stateless">
<!-- security for httpinvoker without csrf protection -->
</http>
<http auto-config="true">
<!-- same as before -->
</http>