春季休息服务被拒绝访问http 403

Question

I have the following configuration for my Spring REST where i would like to have all my web services to go through a basic authentication:

spring-sec.xml

 <http auto-config="true" use-expressions="true">
        <intercept-url pattern="/*" access="hasRole('ROLE_ADMIN')"/>
        <http-basic/>
    </http>

    <!-- Authentication manager -->
    <authentication-manager>
        <authentication-provider>
        <user-service>
            <user name="admin" password="admin" authorities="ROLE_ADMIN"/>
            <user name="rest" password="rest" authorities="ROLE_REST"/>
            <user name="user" password="user" authorities="ROLE_USER"/>
         </user-service>
        </authentication-provider>
    </authentication-manager>

For my client code, i have the following:

String encoding = Base64.getEncoder().encodeToString(("admin:admin").getBytes());

        String authHeader = "Basic " + encoding;

        System.out.println(authHeader);

        HttpPost post = new HttpPost(uri);
        post.setHeader("Content-Type", "application/octet-stream; boundary=\"---Content Boundary\"");
        post.setHeader("Authorization", authHeader);

all the execution of my client are getting http 403 access denied, but as from the code, i am already using the configured username and password. I have also changed from hasRole to hasAuthority, but to no avail. kindly please help on this. thanks!

web.xml:

<context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/spring/root-context.xml, /WEB-INF/spring/appServlet/spring-sec.xml</param-value>
    </context-param>
       <!-- Spring Security filter -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>   

Answer 1

managed to find the issue and its on my spring security xml configuration. from the 403 error, it was stated "Could not verify the provided CSRF token because your session was not found in spring security".

Since the web service is only used by non-browser client, i have disable csrf in the xml configuration, then it works like a charm!

just want to know whether this will be save for my web service? how a csrf function?