Google Appengine Standard : Java8 Setting up Endpoints with IAP and ESP - google-app-engine

I am working on a web application that runs on Google Appengine and is able to be accessed from Android app that will synchronise some data from the server. I had this working smoothly until recent when I recreated the project on GCP and setup IAP, which works fine.
However, I am not able to configure the end point, where I keep getting 500 Server Error. I have followed every step in this online instructions from Google https://cloud.google.com/endpoints/docs/openapi/get-started-app-engine-standard and not able to figure out what am I doing wrong!!
Here are the contents of my files:
Echo.java
package com.example.endpoints;
import ...
#Api(
name = "echo",
version = "v1",
clientIds = { IAP_CREATED_WEBCLIENTID_FROM_CREDENTIALS, Constant.API_EXPLORER_CLIENT_ID},
audiences = {IAP_CREATED_WEBCLIENTID_FROM_CREDENTIALS},
namespace = #ApiNamespace(
ownerDomain = "com.example.endpoints",
ownerName = "com.example.endpoints",
packagePath = "")
)
public class Echo {
#ApiMethod(name = "echoonly", path = "/echo/v1/echoonly")
public Entity echoonly() {
Entity testingResponse = new Entity("TestingResponse", 1000000L);
testingResponse.setProperty("name", "Only");
return testingResponse;
}
#ApiMethod(name = "echoname", path = "/echo/v1/echoname/{name}")
public Entity echoname(
#Named("name") #Nullable String name) {
Entity testingResponse = new Entity("TestingResponse", 1000000L);
testingResponse.setProperty("name", name);
return testingResponse;
}
#ApiMethod(name = "echoage", path = "/echo/v1/echoage/{name}/{age}")
public Entity echoage(
#Named("name") String name,
#Named("age") String age) {
Entity testingResponse = new Entity("TestingResponse", 1000000L);
testingResponse.setProperty("name", name);
testingResponse.setProperty("age", age);
return testingResponse;
}
}
pom.xml (partial only which I think are relevant here...)
<groupId>endpoints</groupId>
<artifactId>endpoints</artifactId>
<properties>
<endpoints.project.id>MYCLOUDRUNSERVICENAME-HASHCODE-uc.a.run.app</endpoints.project.id>
<appengine.maven.plugin.version>2.3.0</appengine.maven.plugin.version>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
<maven.compiler.source>1.8</maven.compiler.source>
<maven.compiler.target>1.8</maven.compiler.target>
<maven.compiler.showDeprecation>true</maven.compiler.showDeprecation>
<endpoints.framework.version>2.2.1</endpoints.framework.version>
<endpoints.management.version>1.0.4</endpoints.management.version>
</properties>
<dependencies>...</dependencies>
<build>
<plugins>...</plugins>
</build>
appengine-web-.xml
<threadsafe>true</threadsafe>
<sessions-enabled>false</sessions-enabled>
<service>default</service> <!-- THIS IS USED TO UPLOAD TO A SPECIFIC SERVICE. REMOVE THIS FOR DEFAULT -->
<runtime>java8</runtime>
<system-properties>
<property name="java.util.logging.config.file"
value="WEB-INF/logging.properties" />
</system-properties>
<env-variables>
<env-var name="ENDPOINTS_SERVICE_NAME" value="${endpoints.project.id}" />
</env-variables>
web.xml
<servlet>
<servlet-name>EndpointsServlet</servlet-name>
<servlet-class>com.google.api.server.spi.EndpointsServlet</servlet-class>
<init-param>
<param-name>services</param-name>
<param-value>com.example.endpoints.Echo</param-value>
</init-param>
</servlet>
<servlet-mapping>
<servlet-name>EndpointsServlet</servlet-name>
<url-pattern>/_ah/api/*</url-pattern>
</servlet-mapping>
<filter>
<filter-name>endpoints-api-configuration</filter-name>
<filter-class>com.google.api.control.ServiceManagementConfigFilter</filter-class>
</filter>
<filter>
<filter-name>endpoints-api-controller</filter-name>
<filter-class>com.google.api.control.extensions.appengine.GoogleAppEngineControlFilter</filter-class>
<init-param>
<param-name>endpoints.projectId</param-name>
<param-value>${endpoints.project.id}</param-value>
</init-param>
<init-param>
<param-name>endpoints.serviceName</param-name>
<param-value>${endpoints.project.id}</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>endpoints-api-configuration</filter-name>
<servlet-name>EndpointsServlet</servlet-name>
</filter-mapping>
<filter-mapping>
<filter-name>endpoints-api-controller</filter-name>
<servlet-name>EndpointsServlet</servlet-name>
</filter-mapping>
deployendpoint.yaml
swagger: '2.0'
info:
title: MyEndPointTestApi771 API
description: Sample API on Cloud Endpoints with a Cloud Run, Cloud Function and App Engine with IAP backend
version: 1.0.0
host: MYCLOUDRUNSERVICENAME-HASHCODE-uc.a.run.app
basePath: /_ah/api
schemes:
- https
consumes:
- application/json
produces:
- application/json
x-google-backend:
address: https://MYPROJECTID.uc.r.appspot.com
jwt_audience: IAP_CREATED_WEBCLIENTID_FROM_CREDENTIALS
x-google-allow: all
paths:
/echo/v1/echoonly:
post:
summary: echoonly
operationId: EchoEchoonly
responses:
'200':
description: A successful response
schema:
$ref: "#/definitions/Entity"
security:
- google_id_token: []
/echo/v1/echoname/{name}:
post:
summary: echoname
operationId: EchoEchoname
parameters:
- in: path
name: name
required: true
type: string
responses:
'200':
description: A successful response
schema:
$ref: "#/definitions/Entity"
security:
- google_id_token: []
/echo/v1/echoage/{name}/{age}:
post:
summary: echoage
operationId: EchoEchoage
parameters:
- in: path
name: name
required: true
type: string
- in: path
name: age
required: true
type: string
responses:
'200':
description: A successful response
schema:
$ref: "#/definitions/Entity"
security:
- google_id_token: []
definitions:
_any:
type: "object"
Entity:
type: "object"
properties:
appId:
type: "string"
key:
$ref: "#/definitions/Key"
kind:
type: "string"
namespace:
type: "string"
parent:
$ref: "#/definitions/Key"
properties:
$ref: "#/definitions/Map_String_Object"
propertiesFrom:
$ref: "#/definitions/Entity"
Map_String_Object:
type: "object"
additionalProperties:
$ref: "#/definitions/_any"
JsonMap:
type: "object"
Key:
type: "object"
properties:
appId:
type: "string"
complete:
type: "boolean"
id:
type: "integer"
format: "int64"
kind:
type: "string"
name:
type: "string"
namespace:
type: "string"
parent:
$ref: "#/definitions/Key"
securityDefinitions:
api_key:
type: "apiKey"
name: "key"
in: "query"
google_id_token:
authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth?client_id=IAP_CREATED_WEBCLIENTID_FROM_CREDENTIALS&response_type=code&scope=openid%20email&access_type=offline&redirect_uri=urn:ietf:wg:oauth:2.0:oob'
flow: "implicit"
type: "oauth2"
x-google-issuer: "https://accounts.google.com"
x-google-jwks_uri: "https://www.googleapis.com/oauth2/v3/certs"
x-google-audiences: "IAP_CREATED_WEBCLIENTID_FROM_CREDENTIALS"
Update
I could not figure this out and went with Spring #RestController which worked perfect, without having to worry about creating Endpoints API on Google Cloud Platform

Related

RAML not showing expected response in Design Centre vs Open api ( swagger ) for XML data

I am trying to design my api in RAML (In Anypoint platform >> Design centre )
Here is an exceprt of my RAML :
#%RAML 1.0 Extension
title: ABC
version: v2
uses:
types: data-types/types.raml
/{code}:
get:
description: Return employee details
responses:
200:
description: The employee details
body:
application/json: types.employeeDetailList
application/xml: types.employeeDetailList
types.employeeDetailList :
#%RAML 1.0 Library
types:
employeeDetailList:
type: array
xml:
name: 'empUnitList'
prefix: 'emp'
namespace: 'http://www.google.com/xsd'
wrapped: true
items:
type: employeeDetail
employeeDetail:
type: object
xml:
name: empName
prefix: emp
wrapped: true
properties:
code:
type: string
example:
"16"
However in design centre it shows incorrectly as :
<?xml version="1.0" encoding="UTF-8"?>
<empUnitList>
<emp:empUnit>
<code>16</code>
</emp:empUnit>
</empUnitList>
However when I do the same in swagger editor - it shows up correctly :
<?xml version="1.0" encoding="UTF-8"?>
<emp:empUnitList xmlns:org="http://www.google.com/xsd">
<emp:empUnit>
<code>16</code>
</emp:empUnit>
</emp:empUnitList>
I cannot use swagger editor I need to use Anypoint Platform design centre and the response in XML is not showing up correctly ...

Internal error during creation of App Engine via deployment manager

I am trying to create an App Engine service via Deployment Manager.
My deployment-manager.yaml file looks like below
imports:
- path: create-app-engine-std.py
resources:
- name: create-app-engine-std-app
type: create-app-engine-std.py
properties:
name: app-engine-std-app
appsId: projectId
zip:
sourceUrl: https://storage.googleapis.com/some-bucket/xyz.zip
filesCount: 2
version: v1
runtime: nodejs8
My create-app-engine-std.py look like below
def GenerateConfig(cxt):
deployment = {}
if cxt.properties['zip']:
deployment = {
'zip': {
'sourceUrl': cxt.properties['zip']['sourceUrl'],
'filesCount': cxt.properties['zip']['filesCount']
}
}
resources = [{
'type': 'gcp-types/appengine-v1:apps.services.versions',
'name': 'app-engine-std-app',
'properties': {
'servicesId': 'app-engine-std-test-app',
'appsId': cxt.properties['appsId'],
'deployment': deployment,
'runtime': cxt.properties['runtime'],
'threadsafe': True,
'id': cxt.properties['version']
}
}]
return {'resources': resources}
When I execute the deployment command I get following error
message: '{"ResourceType":"gcp-types/appengine-v1:apps.services.versions","ResourceErrorCode":"500","ResourceErrorMessage":"An
internal error occurred."}'
I tried using the apps.services.versions.create API but I always get following error although I am owner of the project
{
"error": {
"code": 403,
"message": "The caller does not have permission",
"status": "PERMISSION_DENIED"
}
}
Can someone guide me why I am getting the internal error and why can't I use the API. Thanks...

Expected to find class in file

I'm following the doc about the installation of Sonata Admin Bundle. I'm havong a problem during the step 'Creating an Admin'.
I'm Having the following error :
Expected to find class "AppBundle\Admin\CategoryAdmin" in file
"[...]/src/AppBundle/Admin/CategoryAdmin.php"
while importing services from resource "../../src/AppBundle/*", but it
was not found! Check the namespace prefix used with the resource in
[...]/app/config/services.yml
(which is being imported from
"[...]/app/config/config.yml").
I've created my "Category Admin class"
<?php
// src/Admin/CategoryAdmin.php
namespace App\Admin;
use Sonata\AdminBundle\Admin\AbstractAdmin;
use Sonata\AdminBundle\Datagrid\ListMapper;
use Sonata\AdminBundle\Datagrid\DatagridMapper;
use Sonata\AdminBundle\Form\FormMapper;
use Symfony\Component\Form\Extension\Core\Type\TextType;
class CategoryAdmin extends AbstractAdmin
{
protected function configureFormFields(FormMapper $formMapper)
{
$formMapper->add('name', TextType::class);
}
protected function configureDatagridFilters(DatagridMapper $datagridMapper)
{
$datagridMapper->add('name');
}
protected function configureListFields(ListMapper $listMapper)
{
$listMapper->addIdentifier('name');
}
}
and set them into the config.yml
imports:
- { resource: parameters.yml }
- { resource: security.yml }
- { resource: services.yml }
# Put parameters here that don't need to change on each machine where the app is deployed
# https://symfony.com/doc/current/best_practices/configuration.html#application-related-configuration
parameters:
locale: fr
framework:
#esi: ~
translator: { fallbacks: ['%locale%'] }
secret: '%secret%'
templating:
engines: ['twig']
router:
resource: '%kernel.project_dir%/app/config/routing.yml'
strict_requirements: ~
form: ~
csrf_protection: ~
validation: { enable_annotations: true }
#serializer: { enable_annotations: true }
default_locale: '%locale%'
trusted_hosts: ~
session:
# https://symfony.com/doc/current/reference/configuration/framework.html#handler-id
handler_id: session.handler.native_file
save_path: '%kernel.project_dir%/var/sessions/%kernel.environment%'
fragments: ~
http_method_override: true
assets: ~
php_errors:
log: true
services:
# ...
admin.category:
class: App\Admin\CategoryAdmin
arguments: [~, App\Entity\Category, ~]
tags:
- { name: sonata.admin, manager_type: orm, label: Category }
public: true
# Twig Configuration
twig:
debug: '%kernel.debug%'
strict_variables: '%kernel.debug%'
# Doctrine Configuration
doctrine:
dbal:
driver: pdo_mysql
host: '%database_host%'
port: '%database_port%'
dbname: '%database_name%'
user: '%database_user%'
password: '%database_password%'
charset: UTF8
# if using pdo_sqlite as your database driver:
# 1. add the path in parameters.yml
# e.g. database_path: '%kernel.project_dir%/var/data/data.sqlite'
# 2. Uncomment database_path in parameters.yml.dist
# 3. Uncomment next line:
#path: '%database_path%'
orm:
auto_generate_proxy_classes: '%kernel.debug%'
naming_strategy: doctrine.orm.naming_strategy.underscore
auto_mapping: true
# Swiftmailer Configuration
swiftmailer:
transport: '%mailer_transport%'
host: '%mailer_host%'
username: '%mailer_user%'
password: '%mailer_password%'
spool: { type: memory }
fos_user:
db_driver: orm # other valid values are 'mongodb' and 'couchdb'
firewall_name: main
user_class: AppBundle\Entity\User
from_email:
address: "%mailer_user%"
sender_name: "%mailer_user%"
# config/packages/sonata_admin.yaml
sonata_block:
blocks:
# enable the SonataAdminBundle block
sonata.admin.block.admin_list:
contexts: [admin]
THe route is working so I will not post it.
My project is built like you see under the screenshot :
Symfony Structure
So Is there a problem with how I've built my project or I'm doing something on the config files ?
I've tried to copy/paste files names in case the problem is from a file name but It change anything. Any idea ?
Your namespace is incorrect as it seems from error and first look.
Check following code.
<?php
namespace AppBundle\Admin; # CHANGE THIS LINE TO FOLLOWING!
use Sonata\AdminBundle\Admin\AbstractAdmin;
use Sonata\AdminBundle\Datagrid\ListMapper;
use Sonata\AdminBundle\Datagrid\DatagridMapper;
use Sonata\AdminBundle\Form\FormMapper;
use Symfony\Component\Form\Extension\Core\Type\TextType;
class CategoryAdmin extends AbstractAdmin
{
protected function configureFormFields(FormMapper $formMapper)
{
$formMapper->add('name', TextType::class);
}
protected function configureDatagridFilters(DatagridMapper $datagridMapper)
{
$datagridMapper->add('name');
}
protected function configureListFields(ListMapper $listMapper)
{
$listMapper->addIdentifier('name');
}
}
And services
services:
# ...
admin.category:
class: AppBundle\Admin\CategoryAdmin # fix here
arguments: [~, AppBundle\Entity\Category, ~] # and here
tags:
- { name: sonata.admin, manager_type: orm, label: Category }
public: true

Google appengine cloud tasks alpha handler http 404 error

When I send a task to a task queue it keeps failing and shows a http 404 (not found) error in the logs.
The project has been whitelisted for cloud tasks alpha on flexible.
I can send HTTP post requests to /endpointpath & /tasks/worker locally without any errors.
The endpoint works fine and adds the task to the task queue.
13:37:41.300 POST 200 0 B 422 ms curl/7.54.0 /endpointspath?key=keyremoved 0.0.0.0 - "POST endpointspath?key=keyremoved" 200 undefined "-" "curl/7.54.0"
The app is running as the default service.
app.go main func:
func main() {
r := mux.NewRouter()
r.HandleFunc("/", handler)
r.HandleFunc("/_ah/health", healthCheckHandler)
// Task handlers
r.Path("/tasks/worker").Methods("POST", "GET", "PUT").HandlerFunc(workerTaskHandler)
// Endpoints
r.Path("/endpointpath").Methods("POST").HandlerFunc(searchHandler)
http.Handle("/", r)
port := 8080
if portStr := os.Getenv("PORT"); portStr != "" {
port, _ = strconv.Atoi(portStr)
}
log.Fatal(http.ListenAndServe(fmt.Sprintf(":%d", port), nil))
}
abbreviated app.yaml:
runtime: go
env: flex
handlers:
- url: /tasks/.*
script: _go_app
- url: /.*
script: _go_app
Logs HTTP 404 response when queue dispatches request to worker:
10.0.0.1 - "POST /tasks/worker" 404 200 "-" "AppEngine-Google; (+http://code.google.com/appengine)"
Expand all | Collapse all {
httpRequest: {
latency: "0s"
referer: "-"
remoteIp: "10.0.0.1"
requestMethod: "POST"
requestUrl: "/tasks/worker"
responseSize: "200"
status: 404
userAgent: "AppEngine-Google; (+http://code.google.com/appengine)"
}
insertId: "......."
jsonPayload: {
appLatencySeconds: "-"
latencySeconds: "0.000"
time: null
trace: "......."
}
labels: {
appengine.googleapis.com/instance_name: "......"
appengine.googleapis.com/trace_id: "......."
compute.googleapis.com/resource_id: "......."
compute.googleapis.com/resource_name: "......"
compute.googleapis.com/zone: "us-central1-b"
}
logName: "projects/projectname/logs/appengine.googleapis.com%2Fnginx.request"
receiveTimestamp: "2017-12-09T10:56:14.794726383Z"
resource: {
labels: {
module_id: "default"
project_id: "projectname"
version_id: "....."
}
type: "gae_app"
}
timestamp: "2017-12-09T10:56:10.301Z"
}
The closest I can get GAE to find the tasks/worker url is by setting login:admin in app.yaml (even tho flex doesn't use this for authentication). This returns a 403 unauthorised error.
handlers:
- url: /tasks/.*
script: _go_app
login: admin
Here is the 403 response in the logs
{
httpRequest: {
latency: "0s"
referer: "-"
remoteIp: "10.0.0.1"
requestMethod: "POST"
requestUrl: "/tasks/worker"
responseSize: "162"
status: 403
userAgent: "AppEngine-Google; (+http://code.google.com/appengine)"
}
insertId: "....."
jsonPayload: {
appLatencySeconds: "-"
latencySeconds: "0.000"
time: null
trace: "....."
}
labels: {
appengine.googleapis.com/instance_name: "...."
appengine.googleapis.com/trace_id: "...."
compute.googleapis.com/resource_id: "...."
compute.googleapis.com/resource_name: "....."
compute.googleapis.com/zone: "us-central1-b"
}
logName: "projects/projectname/logs/appengine.googleapis.com%2Fnginx.request"
receiveTimestamp: "2017-12-09T13:35:59.986118082Z"
resource: {
labels: {
module_id: "default"
project_id: "projectname"
version_id: "....."
}
type: "gae_app"
}
timestamp: "2017-12-09T13:35:54.764Z"
}
Not sure if it's related but projectname.appspot.com/_ah/health returns this error:
{
"code": 5,
"message": "Method does not exist.",
"details": [
{
"#type": "type.googleapis.com/google.rpc.DebugInfo",
"stackEntries": [],
"detail": "service_control"
}
]
}
It turns out endpoints can't run on the same service as task handlers. Task handler url requests are blocked by the ESP proxy if they run on the same service in the flexible environment, and the service has the endpoints service enabled.
Run task handlers on a separate service and do not set "endpoints_api_service:" in the task handler service app.yaml file.
Doing so will prevent the queue from being able to dispatch to workers in the flexible environment.
This isn't mentioned in the app engine documentation which is kinda bizarre.
The "/_ah/health" issue was caused by this path not being set in the open api file. If this path isn't set the url isn't recognised by the proxy.

Spring CSRF + AngularJs

I Already tried many of the aswers about this topic, no one works for me.
I Have a basic CRUD with Spring MVC 4.1.7, Spring Security 3.2.3 working on MySQL + Tomcat7.
The problem is, when i try to POST form with AngularJS, I keep being blocked by error 403 ( access denied ).
I figured out that I need to send my CSRF_TOKEN with the POST request, but I can't figure out HOW!
I Tried so many diferent ways and no one works.
My Files
Controller.js
$scope.novo = function novo() {
if($scope.id){
alert("Update - " + $scope.id);
}
else{
var Obj = {
descricao : 'Test',
saldo_inicial : 0.00,
saldo : 33.45,
aberto : false,
usuario_id : null,
ativo : true
};
$http.post(urlBase + 'caixas/adicionar', Obj).success(function(data) {
$scope.caixas = data;
}).error(function(data) {alert(data)});
}
};
Spring-security.xml
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security.xsd">
<!-- enable use-expressions -->
<http auto-config="true" use-expressions="true">
<intercept-url pattern="/seguro**"
access="hasAnyRole('ROLE_USER','ROLE_ADMIN')" />
<intercept-url pattern="/seguro/financeiro**"
access="hasAnyRole('ROLE_FINANCEIRO','ROLE_ADMIN')" />
<!-- access denied page -->
<access-denied-handler error-page="/negado" />
<form-login login-page="/home/" default-target-url="/seguro/"
authentication-failure-url="/home?error" username-parameter="inputEmail"
password-parameter="inputPassword" />
<logout logout-success-url="/home?logout" />
<!-- enable csrf protection -->
<csrf />
</http>
<!-- Select users and user_roles from database -->
<authentication-manager>
<authentication-provider>
<password-encoder hash="md5" />
<jdbc-user-service data-source-ref="dataSource"
users-by-username-query="SELECT login, senha, ativo
FROM usuarios
WHERE login = ?"
authorities-by-username-query="SELECT u.login, r.role
FROM usuarios_roles r, usuarios u
WHERE u.id = r.usuario_id
AND u.login = ?" />
</authentication-provider>
</authentication-manager>
web.xml
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
<display-name>Barattie ~ Soluções Integradas</display-name>
<!-- The definition of the Root Spring Container shared by all Servlets
and Filters -->
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
/WEB-INF/spring/spring-security.xml
/WEB-INF/spring/spring-database.xml
/WEB-INF/spring/spring-hibernate.xml
</param-value>
</context-param>
<context-param>
<param-name>com.sun.faces.writeStateAtFormEnd</param-name>
<param-value>false</param-value>
</context-param>
<!-- Creates the Spring Container shared by all Servlets and Filters -->
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<!-- Processes application requests -->
<servlet>
<servlet-name>appServlet</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/spring/appServlet/servlet-context.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>appServlet</servlet-name>
<url-pattern>/home</url-pattern>
<url-pattern>/</url-pattern>
</servlet-mapping>
<!-- Spring Security -->
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<error-page>
<exception-type>java.lang.Throwable</exception-type>
<location>/erro</location>
</error-page>
UPDATE
I tried to add to rename at client side the xsrf, but I keep getting access denied.
var app = angular.module('myApp', []).config(function($httpProvider) {
$httpProvider.defaults.xsrfCookieName = '_csrf';
$httpProvider.defaults.xsrfHeaderName = 'X-CSRF-Token';
});
** UPDATE 2 **
I tried to implement a filter like this.
package sys.barattie.util;
import java.io.IOException;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.security.web.csrf.CsrfToken;
import org.springframework.web.filter.OncePerRequestFilter;
public class CsrfFilter extends OncePerRequestFilter {
#Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
throws ServletException, IOException {
CsrfToken csrf = (CsrfToken) request.getAttribute(CsrfToken.class.getName());
if (csrf != null) {
Cookie cookie = new Cookie("XSRF-TOKEN", csrf.getToken());
cookie.setPath("/");
response.addCookie(cookie);
}
filterChain.doFilter(request, response);
}
}
And changed my spring security to it.
<csrf token-repository-ref="csrfTokenRepository" />
<beans:bean id="csrfTokenRepository" class="org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository">
<beans:property name="headerName" value="X-XSRF-TOKEN" />
</beans:bean>
Web.xml
<filter>
<filter-name>csrfFilter</filter-name>
<filter-class>sys.barattie.util.CsrfFilter</filter-class>
</filter>
But it is like that the server doesn't run the filter, I've added a System.out.println to it, but can't see the messages in the debug
I did some tests and end up with this.
In my login controller, if my user authentication is successful, I create a token with the name of the AngularJS Token, just like this.
CsrfToken csrf = (CsrfToken) request.getAttribute(CsrfToken.class.getName());
if (csrf != null) {
Cookie cookie = new Cookie("XSRF-TOKEN", csrf.getToken());
cookie.setPath("/");
response.addCookie(cookie);
}
After that, I can manage my $http.post successfully.
I don't know if this is the best way, but is the way that worked for me!
Thanks for the help #Joao Evangelista
The main problem is the integration, Angular always look for a cookie name XSRF-TOKEN and Spring sends a CSRF_TOKEN, you need to provide a filter to change this. Something like this:
private static Filter csrfHeaderFilter() {
return new OncePerRequestFilter() {
#Override
protected void doFilterInternal(HttpServletRequest request,
HttpServletResponse response, FilterChain filterChain)
throws ServletException, IOException {
CsrfToken csrf = (CsrfToken) request.getAttribute(CsrfToken.class.getName())
if (csrf != null) {
Cookie cookie = WebUtils.getCookie(request, "XSRF-TOKEN")
String token = csrf.getToken()
if (cookie == null || token != null && !token.equals(cookie.getValue())) {
cookie = new Cookie("XSRF-TOKEN", token)
cookie.setPath("/")
response.addCookie(cookie)
}
}
filterChain.doFilter(request, response)
}
}
}
static CsrfTokenRepository csrfTokenRepository() {
HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository()
repository.setHeaderName("X-XSRF-TOKEN")
return repository
}
NOTICE The only example I have is this, is written in Groovy, but is just missing some ;
Then you need to add the filter and the repository to <csrf/> properties, you can explicity set a class implementing a Filter as <bean>, using #Component or declaring this methods as #Bean on a configuration class
Otherwise you can change the $http configuration on Angular, according to docs setting this settings to match Spring token cookie name and header name
xsrfHeaderName – {string} – Name of HTTP header to populate with the XSRF token.
xsrfCookieName – {string} – Name of cookie containing the XSRF token.
More info about this you can check the docs on Usage section
i was facing this problem also, and this is the solution that is working for me (from the Spring documentation), notice that im not using $http. Instead im using $resource.
'
You can ask Spring to save a cookie with Angular's defaults:
<csrf token-repository-ref="tokenRepository"/>
...
</http>
<b:bean id="tokenRepository"
class="org.springframework.security.web.csrf.CookieCsrfTokenRepository"
p:cookieHttpOnly="false"/>
Please notice that if you use $http, there is a field in the config object called xsrfCookieName, where you can set explicitly the name of the cookie. But this option i havent tried it, so i dont know how useful it is.
Best Regards.
This should work:
Class that extends WebSecurityConfigurerAdapter:
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf()
.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
..
And then in your AngularJS you can use any module for csrf, etc.: spring-security-csrf-token-interceptor

Resources