Form submission fails (invalid CSRF token) after Ajax GET request. How to fix?

Question

I have a "customer detail" form that submits a POST request. This is in a Spring Boot application and is implemented as a Thymeleaf template. I have just added a little AJAX function to the form -- when the user clicks a certain button, it uses jQuery.ajax() to look up a geo-code based on the customer's address. The AJAX call is a GET request.

If I enter the customer form and click "Submit" without touching the Ajax button, it submits normally. But if I use the Ajax button first, and then try to submit the form, it gets stopped by the CsrfFilter with a message "Invalid CSRF token found for http://...".

I assume that the Ajax call is somehow making the CSRF token expire, so that a new one is needed, but how can I prevent that?

There are some similar-sounding questions like this one but in that case they're looking for a way to add a CSRF token to an Ajax request. Also, I'm using Thymeleaf views so I get the CSRF token automatically inserted into my form -- I don't have to add it manually.

Answer 1

The problem was that I had implemented a custom filter to delete the security context on every request. This was my way of making the application stateless, as I documented in this software engineering SE answer. That deletes (or resets?) the server-side CSRF token so it won't match the one in the form, however, the custom filter fires after the CsrfFilter so I never had a problem with form submission before.

In this case though I have Ajax requests that are handled after the form is built for the client but before it is submitted, so my custom filter's unfortunate side effect causes form submission to fail.

I corrected it by modifying the custom filter to skip deleting the context if the URL is under a particular directory path:

public class SecurityContextDeletingFilter extends GenericFilterBean {

    RequestMatcher exceptedPaths = new AntPathRequestMatcher("/form-ajax/**");

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        final HttpServletRequest request = (HttpServletRequest) servletRequest;
        final HttpSession session = request.getSession();

        if( exceptedPaths.matches(request)) {
            // Deleting the security context deletes the CSRF token in the session. We want to make sure this
            // does NOT occur if the user is in a form and is using Ajax features like the geocode lookup,
            // because they'll need the server to recognize the token on eventual form submission.
            logger.trace("Skipping this filter for a /form-ajax/ endpoint.");
        } else {
            if( session.getAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY) != null ) {
                session.removeAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY);
            }
        }

        filterChain.doFilter(servletRequest,servletResponse);
    }
}