26 lines
1.1 KiB
Plaintext
26 lines
1.1 KiB
Plaintext
==============================================================================
|
|
docs/output/09-error-dispatch.txt
|
|
The identical CSRF failure, with one extra filter chain that permits /error.
|
|
Profile: csrfnaive,errorpermit
|
|
==============================================================================
|
|
|
|
HTTP/1.1 403
|
|
Vary: Origin
|
|
Vary: Access-Control-Request-Method
|
|
Vary: Access-Control-Request-Headers
|
|
Set-Cookie: XSRF-TOKEN=<token>; Path=/
|
|
X-Content-Type-Options: nosniff
|
|
X-XSS-Protection: 0
|
|
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
|
|
Pragma: no-cache
|
|
X-Frame-Options: DENY
|
|
|
|
{"timestamp":"<timestamp>","status":403,"error":"Forbidden","path":"/api/data"}
|
|
|
|
# 403, and a body. Without the /error chain the same request answers 401 with an
|
|
# empty body and a WWW-Authenticate header - see 08. AccessDeniedHandlerImpl calls
|
|
# response.sendError(403), the container re-dispatches to /error, and the security
|
|
# chain runs a second time on that dispatch. BasicAuthenticationFilter extends
|
|
# OncePerRequestFilter and skips error dispatches, so the second pass is anonymous
|
|
# and AuthorizationFilter answers 401 over the top of the 403.
|