在 Spring 引导中禁用 CSRF / CORS 启动：Spring 安全 5.7 和 SAML

Question

I am using a Spring Boot application with the latest stable versions of Spring Boot and Sprign Security. I am doing authentication with an ADFS IDP using SAML2. That works fine for all GET requests. Now I need to use PUT and POST and therfore I'd like to disable csrf.

With this pease of code I tried to disable csrf:

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().and().cors().disable();
    }

}

But when doing this the complete SAML Authentication gets lost and no Single-Sign-On and so on is performed. I am using SAML2 by configuration:

spring:
  security:
    saml2:
      relyingparty:
        registration:
          DemoApp: 
            entity-id: urn:id:demo-app
            identityprovider:
              entity-id: "http://adfs.local/adfs/services/trust"
              metadata-uri: "https://adfs.local/FederationMetadata/2007-06/FederationMetadata.xml"     
              singlesignon:
                url: "https://adfs.local/adfs/ls"
                sign-request: true

How do I disable csrf and keep the SAML2 things working?

Answer 1

WebSecurityConfigurerAdapter is deprecated. Use a SecurityFilterChain Bean to configure HttpSecurity or a WebSecurityCustomizer Bean to configure WebSecurity. Try this

@Bean
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
    http
            .csrf().disable()
            .cors().disable();      
    return http.build();
}

Answer 2

The Java configuration below will disable CSRF protection in Spring security 5.7

@Configuration
@EnableWebSecurity
public class WebSecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable());
        return http.build();
    }
}

For more details follow the link below

https://docs.spring.io/spring-security/reference/servlet/exploits/csrf.html#servlet-csrf-configure-disable