启用 CSRF 时无法访问 Spring 安全/登录端点

Question

I've found quite a few questions about this, but no real answers in my case. I am using Spring with Java on my back-end and a React front-end with Axios JS. When trying to access the /login endpoint to authenticate via form login, I get a 403 response due to an invalid CSRF token.

Is there a way around this besides disabling CSRF for /login ? Is that considered "secure"? It is my understanding that the server will send the CSRF token, and my front-end does not communicate with the back-end before authenticating via /login . Below are my security configuration and Axios call.

Thanks!

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
    CsrfTokenRepository repository = CookieCsrfTokenRepository.withHttpOnlyFalse();

    Customizer<CorsConfigurer<HttpSecurity>> corsCustomizer = Customizer.withDefaults();

    AuthenticationSuccessHandler successHandler = (request, response, authentication) -> {
        int status = HttpStatus.OK.value();

        response.setStatus(status);
    };

    AuthenticationFailureHandler failureHandler = (request, response, exception) -> {
        int status = HttpStatus.UNAUTHORIZED.value();

        response.setStatus(status);
    };

    Customizer<ExceptionHandlingConfigurer<HttpSecurity>> exceptionCustomizer = (configurer) -> {
        HttpStatusEntryPoint entryPoint = new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED);

        configurer.authenticationEntryPoint(entryPoint);
    };

    httpSecurity.csrf()
                .csrfTokenRepository(repository)
                .and()
                .cors(corsCustomizer)
                .authorizeHttpRequests()
                .anyRequest()
                .authenticated()
                .and()
                .formLogin()
                .successHandler(successHandler)
                .failureHandler(failureHandler)
                .and()
                .httpBasic()
                .and()
                .exceptionHandling(exceptionCustomizer);

    return httpSecurity.build();
} //securityFilterChain

const formData = new FormData();

formData.append("username", username);

formData.append("password", password);

const config = {
    "withCredentials": true
};

const axios = require("axios").default;

return new Promise<void> ((resolve, reject) => {
    axios.post("http://localhost:8080/login", formData, config)
         .then((response: AxiosResponse) => {
             resolve();
         })
         .catch(() => {
             reject();
         });
});

Answer 1

At time 0 you don't have a CSRF cookie, so you need to retrieve it. Make any GET call first and be sure to always send the token.