"status": 403, "error": "Forbidden", "message": "Forbidden", "path": "/post/create"

Question

I see this response when I try to add new post after authorization by admin.

I have Basic authorization which based on spring boot security:

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    //...declared fields
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth
                .inMemoryAuthentication()
                .passwordEncoder(passwordEncoder())
                .withUser("user")
                .password("userpass")
                .roles("USER")
                .and()
                .withUser("admin")
                .password("adminpass")
                .roles("ADMIN", "USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .antMatchers("/login").permitAll()
                .antMatchers("/logout").permitAll()
                .anyRequest().authenticated()
                .and()
                .httpBasic()
                .and().logout().permitAll()
                .and()
                .formLogin()
                .loginProcessingUrl("/login")
                .permitAll()
                .and().logout().logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                .logoutSuccessUrl("/login");
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

I get this message when try to add new post after authorization:

{
    "timestamp": "2018-07-04T12:19:25.638+0000",
    "status": 403,
    "error": "Forbidden",
    "message": "Forbidden",
    "path": "/post/create"
}

in my controller:

@RestController
public class PostController {
    @Autowired
    private PostDAO postDAO;

    @GetMapping("/posts")
    public Page<Post> getAllPosts(Pageable pageable) {
        return postDAO.findAll(pageable);
    }

    @PostMapping("/post/create")
    public Post createPost(@Valid @RequestBody Post post) {
        return postDAO.save(post);
    }
    //other end-points........
}

However, read operations from my controller work well but to CRUD operation I haven't access.

There are my dependencies:

dependencies {
    compile ('org.springframework.boot:spring-boot-starter-web')
    compile('org.springframework.boot:spring-boot-starter-data-jpa')
    compile('org.hibernate:hibernate-core')
    compile('org.springframework.boot:spring-boot-starter-security')
    runtime('mysql:mysql-connector-java')
    testCompile('org.springframework.boot:spring-boot-starter-test')
    testCompile('org.springframework.security:spring-security-test')
    testCompile('junit:junit')
}

Any idea? Thanks in advance!

You need to set jsession id in header and check csrf configuration — Sumesh TG, Jul 04 '18 at 14:20
http .csrf().disable() .authorizeRequests() .anyRequest().permitAll(); Try disable csrf. — Sumesh TG, Jul 04 '18 at 14:30

Sumesh TG · Accepted Answer · 2018-10-03T10:15:58.360

This is due to CSRF enabled. CSRF protection is enabled by default in the Java configuration. We can still disable CSRF using the configuration given below.

http .csrf().disable() .authorizeRequests() .anyRequest().permitAll();

Starting from Spring Security 4.x – the CSRF protection is enabled by default in the XML configuration as well; we can of course still disable it if we need to:

<http>
    ...
    <csrf disabled="true"/>
</http>

Note : CSRF is an attack which forces an end user to execute unwanted actions in a web application in which is currently authenticated.

score 1 · Answer 2 · answered Dec 29 '20 at 14:42

here's why: csrf is automatically enabled in spring security,and I recommended you do not disable csrf. normally your html form tag should include a hidden field which generates csrf token, however, thymeleaf automaticlly do that for you, you should check your html tag to see whether or not a "th:" was included, if not, include a "th:" before "action" in form tag, do this, thymeleaf generates csrf token invisibablly.

"status": 403, "error": "Forbidden", "message": "Forbidden", "path": "/post/create"

2 Answers2

Linked