Question

0

207

Views

Spring security 405 with disabled csrf

I have a project in which I've implemented spring security. Whenever I try to use the login page, I get a 405 response 'Request method 'POST' not supported'. I've searched for a solution over the web, and as far as i saw the only solution is to disable csrf. I've disabled csrf, but i still receiving the same 405 response.

SecurityConfig.java

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter{

@Autowired
private BCryptPasswordEncoder encoder;
@Autowired
private DataSource dataSource;

@Autowired
public void configAuthentication(AuthenticationManagerBuilder auth) throws Exception {

  auth.jdbcAuthentication().dataSource(dataSource())
    .usersByUsernameQuery(
        "select username, password, enabled from user where username=?")
    .authoritiesByUsernameQuery(
        "select user_username, role from user_roles where user_username=?").passwordEncoder(encoder);
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
    .authorizeRequests()
        .antMatchers("/resources/**").permitAll()
        .anyRequest().authenticated()
        .and()
    .formLogin()
        .loginPage("/login.html").usernameParameter("username").passwordParameter("password")
        .loginProcessingUrl("/mylogin")
        .successForwardUrl("/test.html")
        .permitAll()
        .and()
        .csrf().disable();
}}

login.html

    <form action="/mylogin" method="post" name="login" id="login">

<div>
    <span>username</span>
    <input type="text"  placeholder="Username" name="username">
</div>
<br/>
<div>
    <span >password</span>
    <input type="password"  placeholder="Password" name="password">
</div>
<br/>       
<div>
    <input type="submit" value="send">
</div>

Am i missing something?

MySystemApplication

@SpringBootApplication
@EntityScan("com.myapp")
@EnableJpaRepositories("com.myapp")
@ComponentScan({"com.myapp"})
public class MySystemApplication {


public static void main(String[] args) {
    SpringApplication.run(MySystemApplication.class, args);
}


}

over 4 years ago · Santiago Trujillo

1 answers

Answer question

0

Answer question

Find remote jobs

Answer 1 · 2022-05-26T16:27:22.806Z

Please I must advise you enable your csrf. Never you disable it except you want to try out something on development environment. Remember to enable it immediately after testing whatever else your site will be prone to cross site request forgery attack.

So enable csrf and add

<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>

to your form in login.jsp

OR

Preferably, always use spring tag

<%@ taglib uri="http://www.springframework.org/tags/form" prefix="f"%>

for your form

<f:form></f:form>

so you won't have to worry about remembering to add that csrf token tag to your forms as spring will do that automatically by default. That's the best practice.

0

207