Search code examples
spring-mvcspring-securitycsrf

Request method 'POST' not supported after session expires

I am running an Spring MVC web application with Spring Security. Whenever I submit/refresh a page after the session expired (with POST) I am getting:

Request method 'POST' not supported

Here is the error log. If I disable CSRF in the Spring Security then it is working fine.

org.springframework.web.HttpRequestMethodNotSupportedException: Request method 'POST' not supported
at org.springframework.web.servlet.mvc.method.RequestMappingInfoHandlerMapping.handleNoMatch(RequestMappingInfoHandlerMapping.java:204)
at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.lookupHandlerMethod(AbstractHandlerMethodMapping.java:382)
at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.getHandlerInternal(AbstractHandlerMethodMapping.java:322)
at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.getHandlerInternal(AbstractHandlerMethodMapping.java:60)
at org.springframework.web.servlet.handler.AbstractHandlerMapping.getHandler(AbstractHandlerMapping.java:351)
at org.springframework.web.servlet.DispatcherServlet.getHandler(DispatcherServlet.java:1120)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:932)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:893)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:969)
at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:871)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:845)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:121)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:728)
at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:467)
at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:392)
at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:311)
at org.springframework.security.web.firewall.RequestWrapper$FirewalledRequestAwareRequestDispatcher.forward(RequestWrapper.java:139)
at org.springframework.security.web.access.AccessDeniedHandlerImpl.handle(AccessDeniedHandlerImpl.java:71)
at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:110)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:91)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:53)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:213)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:176)
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:478)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80)
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:624)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:799)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1455)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)

Here is my Spring configuration

http
    .authorizeRequests()
        .antMatchers("/login**").permitAll()
        .antMatchers("/help**").permitAll()
        .antMatchers("/faq/**").permitAll()
        .antMatchers("/denied").permitAll()
        .and()
    .formLogin()
        .loginPage("/login")
        .successHandler(customSuccessHandler())
        .and()
    .logout()
        .logoutUrl("/login?logout")
        .invalidateHttpSession(true).deleteCookies("JSESSIONID")
        .and()
    .exceptionHandling()
        .accessDeniedPage("/denied")
        .and()
    .exceptionHandling()
        .authenticationEntryPoint(ssoAuthenticationEntryPoint())
        .and()
    .addFilterBefore(userNameTransformationFilter(), UsernamePasswordAuthenticationFilter.class)
    .addFilterBefore(customPreAuthSecurityFilter(), BasicAuthenticationFilter.class)
    .addFilterAfter(waffleNegotiateSecurityFilter(), BasicAuthenticationFilter.class)
    .addFilterAfter(customNegotiateSecurityFilter(), BasicAuthenticationFilter.class)
    .authorizeRequests()
        .anyRequest().fullyAuthenticated();

Here is the authentication entry point java class

    public class SSOAuthenticationEntryPoint extends NegotiateSecurityFilterEntryPoint {

    private static final Logger logger = Logger.getLogger(SSOAuthenticationEntryPoint.class);

    /*
     * (non-Javadoc)
     * @see org.springframework.security.web.AuthenticationEntryPoint#commence(javax.servlet.http.HttpServletRequest,
     * javax.servlet.http.HttpServletResponse, org.springframework.security.core.AuthenticationException)
     */
    @Override
    public void commence(final HttpServletRequest request, final HttpServletResponse response,
                         final AuthenticationException ex) throws IOException, ServletException {
        String ctxPath = ((HttpServletRequest) request).getContextPath();
        String requestURI = request.getRequestURI();
        logger.info(" start authentication process - " + requestURI);
        if (("" + ctxPath + "/rest/sso").equalsIgnoreCase(requestURI)) {
            super.commence(request, response, ex);
        } else {
            Boolean hasCheckedSSO = (Boolean) request.getSession().getAttribute(SecurityConstants.ATTR_HAS_CHECKED_SSO);
            Boolean ssoUserNotFound = (Boolean) request.getSession().getAttribute(SecurityConstants.ATTR_SSO_USER_NOT_FOUND);
            logger.info("hasCheckedSSO = " + hasCheckedSSO + ", ssoUserNotFound = " + ssoUserNotFound);
            String target = request.getRequestURI() + (request.getQueryString() != null ? "?" + request.getQueryString() : "");
            request.getSession().setAttribute(SecurityConstants.ATTR_TARGET, target);
            if (ssoUserNotFound != null && ssoUserNotFound) {
                response.sendRedirect(ctxPath + "/login?noaccess");
            } else if (hasCheckedSSO == null) {
                request.getSession().setAttribute("hasCheckedSSO", Boolean.TRUE);
                target = URLEncoder.encode(target, "UTF-8");
                response.sendRedirect(ctxPath + "/checkSSO?target=" + target);
            } else {
                response.sendRedirect(ctxPath + "/login");
            }
        }

    }
}

Any suggestion please?

Solution

  • If your session is expired, your request contains a not valid CSRF token (or no CSRF token at all) and your access is denied.

    You configured an access denied page, which creates an AccessDeniedHandler, see ExceptionHandlingConfigurer#accessDeniedPage:

    Shortcut to specify the AccessDeniedHandler to be used is a specific error page

    This base AccessDeniedHandler forwards (no redirection) your request to the access denied page, see AccessDeniedHandlerImpl:

    This implementation sends a 403 (SC_FORBIDDEN) HTTP error code. In addition, if an errorPage is defined, the implementation will perform a request dispatcher "forward" to the specified error page view. Being a "forward", the SecurityContextHolder will remain populated. This is of benefit if the view (or a tag library or macro) wishes to access the SecurityContextHolder. The request scope will also be populated with the exception itself, available from the key WebAttributes.ACCESS_DENIED_403.

    So you need an access denied page supporting not only HTTP GET but also POST and all other used HTTP methods.