Spring Boot and CSRF with AngularJS - Forbitten 403 & # 8594; incorrect logout

Question

In my Spring Boot / AngularJS application, I have the following CSRF configuration:

@Override
protected void configure(final HttpSecurity http) throws Exception {
    http.csrf().csrfTokenRepository(csrfTokenRepository());    http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

    final String[] restEndpointsToSecure = WebSecurityConfig.restEndpointsToSecure;
    for (final String endpoint : restEndpointsToSecure) {
        http.authorizeRequests().antMatchers("/" + endpoint + "/**").hasRole(UserRoleEnum.USER.toString());
    }

    http.addFilterAfter(csrfTokenResponseHeaderBindingFilter(), CsrfFilter.class);

    xAuthTokenConfigurer.setDetailsService(userDetailsServiceBean());
    final SecurityConfigurer<DefaultSecurityFilterChain, HttpSecurity> securityConfigurerAdapter = xAuthTokenConfigurer;
    http.apply(securityConfigurerAdapter);
}

The CSRF-Token filter is as follows:

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, javax.servlet.FilterChain filterChain)
        throws ServletException, IOException {

    final CsrfToken csrf = (CsrfToken)request.getAttribute(CsrfToken.class.getName());
    if (csrf != null) {
        Cookie cookie = WebUtils.getCookie(request, "XSRF-TOKEN");
        final String token = csrf.getToken();
        if (cookie == null || token != null && !token.equals(cookie.getValue())) {
            cookie = new Cookie("XSRF-TOKEN", token);
            cookie.setPath("/");
            response.addCookie(cookie);
        }
    }
    filterChain.doFilter(request, response);
}

In general, it works fine, the X-XSRF-TOKEN header request property is sent with every request. BUT I have strange behavior. I am updating my user profile in the application. The first time it works fine, the second, I get HTTP 403 Forbidden, and actually I really don't know why. I do nothing between these two updates (without navigating to other pages between the two updates or something else).

, , - . , Response Set-Cookie X-Application-context. .

- , . .

Answer 1

, front-end userProfile.controller

- error

Cookie SessionID , INVALID_SESSIONID

• CORS , CORS , .

• OPTIONS http 200

   static final String ORIGIN = "Origin";
  
  if (request.getHeader(ORIGIN).equals("null")) {
          String origin = request.getHeader(ORIGIN);
          response.setHeader("Access-Control-Allow-Origin", "*");//* or origin as u prefer
          response.setHeader("Access-Control-Allow-Credentials", "true");
         response.setHeader("Access-Control-Allow-Headers",
                  request.getHeader("Access-Control-Request-Headers"));
      }
      if (request.getMethod().equals("OPTIONS")) {
          try {
              response.getWriter().print("OK");
              response.getWriter().flush();
          } catch (IOException e) {
              e.printStackTrace();
          }
      }
  

        //your other configs
        < security:custom-filter ref="corsHandler" after="PRE_AUTH_FILTER"/>