具有Security＆REST端点的Spring MVC给出了403“由于未找到您的会话，因此无法验证提供的CSRF令牌”

Question

I have a Java Spring-boot microservice where I have an admin website and REST endpoints. The website is accessed at myserver.com/serverwebpages and the REST web service is at myserver.com/api/restendpoints. I am using Spring MVC with login security and CSRF on the web side and HMAC Authorization on the REST endpoint side. I have @Controller annotation on the website side and @RestController annotation for the REST web service. The website works fine and the webservice works fine with GET's. However, I just tried a DELETE and got a 403, error:forbidden, message:"Could not verify the provided CSRF token because your session was not found". It looks like the MVC security is seeing REST webservice requests and calling out the CSRF error because I have not provided a CSRF number. Of course, I do provide CSRF's on the web page side for MVC cross-scripting security. Anyone know how to fix this? Do I need to create a separate microservice with a different port?

Answer 1

When you call DELETE method, they need CSRF token. Maybe your DELETE API doesn't carry CSRF token. You need to add CSRF token in Request Header.

Adding CSRF in Header is depends on Ajax framework. If your combination is Spring-Security + Thymeleaf + jQuery, then refer Spring Security Document :
https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html#csrf-include-csrf-token-ajax

Answer 2

I could not figure out a solution to the problem using Spring MVC. So I just created 2 separate microservices on the same AWS instance. One microservice with port number 443 handles the web services and uses Spring MVC. The other microservice with port 8443 handles all of the REST API calls with no Spring MVC. This worked perfectly. Disappointed that I could not find an answer but had to move on.