[весна OAuth безопасности] ACCESS_DENIED: Ожидаемая CSRF токена не найдена

Question

я практикую пружинный oauth2 безопасности с учетными данными клиента предоставить тип
Вот мои файлы XML для OAuth пружинной безопасности

<?xml version="1.0" encoding="UTF-8"?> 
<beans xmlns="http://www.springframework.org/schema/beans" 
    xmlns:context="http://www.springframework.org/schema/context" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oauth="http://www.springframework.org/schema/security/oauth2" 
    xmlns:sec="http://www.springframework.org/schema/security" xmlns:mvc="http://www.springframework.org/schema/mvc" 
    xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.0.xsd 
     http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd 
     http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.1.xsd 
     http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.1.xsd 
     http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.1.xsd"> 


    <sec:debug /> 
    <oauth:authorization-server 
     client-details-service-ref="clientDetails" token-services-ref="tokenServices"> 
     <oauth:client-credentials /> 
    </oauth:authorization-server> 

    <sec:authentication-manager alias="clientAuthenticationManager"> 
     <sec:authentication-provider 
      user-service-ref="clientDetailsUserService"> 
     </sec:authentication-provider> 
    </sec:authentication-manager> 

    <http pattern="/oauth/token" create-session="stateless" 
     authentication-manager-ref="clientAuthenticationManager" 
     xmlns="http://www.springframework.org/schema/security"> 
     <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" /> 
     <anonymous enabled="false" /> 
     <http-basic entry-point-ref="clientAuthenticationEntryPoint" /> 
     <!-- include this only if you need to authenticate clients via request 
      parameters --> 
     <custom-filter ref="clientCredentialsTokenEndpointFilter" 
      before="BASIC_AUTH_FILTER" /> 
     <access-denied-handler ref="oauthAccessDeniedHandler" /> 
    </http> 

    <oauth:resource-server id="resourceServerFilter" 
     resource-id="rest_server" token-services-ref="tokenServices" /> 

    <oauth:client-details-service id="clientDetails"> 
     <oauth:client client-id="abc" authorized-grant-types="client_credentials" 
      authorities="ROLE_RESTREAD" secret="123" /> 
    </oauth:client-details-service> 

    <http pattern="/**" create-session="never" entry-point-ref="oauthAuthenticationEntryPoint" 
     access-decision-manager-ref="accessDecisionManager" 
     xmlns="http://www.springframework.org/schema/security"> 
     <anonymous enabled="false" /> 

     <intercept-url pattern="/prot**" access="ROLE_RESTREAD" 
      method="GET" /> 
     <custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /> 
     <access-denied-handler ref="oauthAccessDeniedHandler" /> 
    </http> 




    <bean id="tokenStore" 
     class="org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore" /> 


    <bean id="tokenServices" 
     class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"> 
     <property name="tokenStore" ref="tokenStore" /> 
     <property name="supportRefreshToken" value="false" /> 
     <property name="clientDetailsService" ref="clientDetails" /> 
     <property name="accessTokenValiditySeconds" value="400000" /> 
     <property name="refreshTokenValiditySeconds" value="0" /> 
    </bean> 

    <bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased" 
     xmlns="http://www.springframework.org/schema/beans"> 
     <constructor-arg> 
      <list> 
       <bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" /> 
       <bean class="org.springframework.security.access.vote.AuthenticatedVoter" /> 
       <bean 
        class="org.springframework.security.web.access.expression.WebExpressionVoter" /> 
      </list> 
     </constructor-arg> 
    </bean> 

    <bean id="oauthAuthenticationEntryPoint" 
     class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"> 
     <property name="realmName" value="theRealm" /> 
    </bean> 

    <bean id="clientAuthenticationEntryPoint" 
     class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"> 
     <property name="realmName" value="theRealm/client" /> 
     <property name="typeName" value="Basic" /> 
    </bean> 

    <bean id="clientCredentialsTokenEndpointFilter" 
     class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"> 
     <property name="authenticationManager" ref="clientAuthenticationManager" /> 
    </bean> 



    <bean id="clientDetailsUserService" 
     class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"> 
     <constructor-arg ref="clientDetails" /> 
    </bean> 

    <bean id="oauthAccessDeniedHandler" 
     class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" /> 


    <sec:global-method-security 
     pre-post-annotations="enabled" proxy-target-class="true"> 
     <sec:expression-handler ref="oauthExpressionHandler" /> 
    </sec:global-method-security> 

    <oauth:expression-handler id="oauthExpressionHandler" /> 

    <oauth:web-expression-handler id="oauthWebExpressionHandler" /> 

</beans> 

И я проверить на макинтош терминале:

curl -X -v -d 'client_id=abc&client_secret=123&grant_type=client_credentials' -X POST "http://localhost:8080/WiBDA_User/oauth/token" 

Но есть ошибка:

{"error":"access_denied","error_description":"Expected CSRF token not found. Has your session expired?"} 

Скажите, пожалуйста, что случилось? Спасибо.

Answer 1

Начиная с Spring Security 4.0, защита по CSRF включена по умолчанию с конфигурацией XML. Если вы хотите отключить защиту CSRF, соответствующую конфигурацию XML можно увидеть ниже.

<http> 
    <csrf disabled="true"/> 
</http> 

Источник: http://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html#csrf-configure

UPDATE: Пожалуйста, обновите свой код на новую Java-конфигурации, легко понять и настроить.