使用spring security和angular js登录返回403

Question

I'm learning spring and angularjs. I'm trying to make a login following this guide spring-security-angular/single

this is my SecurityConfig

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("a").password("a").roles("ADMIN");
        auth.inMemoryAuthentication().withUser("b").password("b").roles("USER");
        auth.inMemoryAuthentication().withUser("c").password("c").roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //http single
        http.httpBasic().and().authorizeRequests()
                .antMatchers("/index.html", "/home.html", "/login.html", "/", "/**").permitAll().anyRequest()
                .authenticated().and().csrf()
                .csrfTokenRepository(csrfTokenRepository()).and()
                .addFilterAfter(csrfHeaderFilter(), CsrfFilter.class);
    }

    private Filter csrfHeaderFilter() {
        return new OncePerRequestFilter() {
            @Override
            protected void doFilterInternal(HttpServletRequest request,
                                            HttpServletResponse response, FilterChain filterChain)
                    throws ServletException, IOException {
                CsrfToken csrf = (CsrfToken) request.getAttribute(CsrfToken.class
                        .getName());
                if (csrf != null) {
                    Cookie cookie = WebUtils.getCookie(request, "XSRF-TOKEN");
                    String token = csrf.getToken();
                    if (cookie == null || token != null
                            && !token.equals(cookie.getValue())) {
                        cookie = new Cookie("XSRF-TOKEN", token);
                        cookie.setPath("/");
                        response.addCookie(cookie);
                    }
                }
                filterChain.doFilter(request, response);
            }
        };
    }

    private CsrfTokenRepository csrfTokenRepository() {
        HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
        repository.setHeaderName("X-XSRF-TOKEN");
        return repository;
    }

my angular service

    .config(function($stateProvider, $httpProvider) {

        $httpProvider.defaults.headers.common['X-Requested-With'] = 'XMLHttpRequest';
    })
    .factory('sessionService', function($http, $base64, $q, $rootScope) {
        var session = {};

        session.login = function(credentials) {
            var defered = $q.defer();
            var promise = defered.promise;

            var headers = credentials ? {  authorization : "Basic "
                + btoa(credentials.username + ":"
                    + credentials.password)
            } : {};

            $http.get('/user', {
                headers : headers
            }).success(function(data) {
                if (data.name) {
                    $rootScope.authenticated = true;
                    defered.resolve(data);
                } else {
                    $rootScope.authenticated = false;
                    defered.reject(data);
                }

            }).error(function(data) {
                $rootScope.authenticated = false;
                defered.reject(data);
            });

and this is the UserController

    @RestController
    public class UserCntroller {

        @RequestMapping("/user")
        public Principal user (Principal user){
            return user;
        }

but when making the login, I get 403.

Answer 1

The request method in your screenshot seems to be GET, so CSRF shouldn't be blocking it. I suspect something else, like you are trying to access the URL (/user) without first authenticating properly. Maybe you could include "/user" in the antMatchers(...).permitAll() and see what happens.