CSRF 令牌已与此客户端关联

Question

I am using spring-boot-starter-security-2.4.2 . I am getting issue of

CSRF Token has been associated to this client

when using in Postman.

Here I am using Spring Cloud Gateway and I added Spring Security for this.

POST: localhost:8080/auth/login

body: {
    "username": "user",
    "password": "pass"
}

I also tried with curl:

curl -d "username=user1&password=abcd" -X POST http://localhost:8080/auth/login

Below is my Spring Security configuration:

@Override
protected void configure(HttpSecurity http) throws Exception {
    http=http
        .cors()
            .and()
        .csrf().disable();

    http=http
        .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and();

    http=http
        .exceptionHandling()
            .authenticationEntryPoint(jwtAuthenticationEntryPoint)
            .and();
        
    http
        .authorizeRequests()
            .antMatchers(HttpMethod.POST, "/auth/login/").permitAll()
            .antMatchers(HttpMethod.POST, "/public/user/links").permitAll()
            .anyRequest().authenticated();
        
    http
        .addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
}

Answer 1

This issue is fixed after lots of trials

@EnableWebFluxSecurity
@EnableReactiveMethodSecurity
public class WebSecurityConfig {

    @Autowired
    private AuthenticationManager authenticationManager;
    
    @Autowired
    private SecurityContextRepository securityContextRepository;
    
    @Autowired
    private JwtWebFilter jwtWebFilter;

    @Bean
    public SecurityWebFilterChain securitygWebFilterChain(ServerHttpSecurity http) {
        return http
            .exceptionHandling()
            .authenticationEntryPoint((swe, e) -> {
                return Mono.fromRunnable(() -> {
                    swe.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
                });
            }).accessDeniedHandler((swe, e) -> {
                return Mono.fromRunnable(() -> {
                    swe.getResponse().setStatusCode(HttpStatus.FORBIDDEN);
                });
            }).and()
            .csrf().disable()
            
            .authenticationManager(authenticationManager)
            .securityContextRepository(securityContextRepository)
            .authorizeExchange()
            .pathMatchers("/auth/login").permitAll()
            .anyExchange().authenticated()
            .and().addFilterAfter(jwtWebFilter, SecurityWebFiltersOrder.FIRST)
            .build();
    }
    
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    
}

it is working fine wih Gateway service m but not the down stream service. filter is not calling for other eureka clients. can anyone help?