48 lines
1.6 KiB
Plaintext
48 lines
1.6 KiB
Plaintext
==============================================================================
|
|
docs/output/10-csrf-spa.txt
|
|
The same flow under csrf.spa(), added in Spring Security 7.0.
|
|
Profile: csrfspa
|
|
==============================================================================
|
|
|
|
# 1. The bootstrap GET now DOES set the cookie.
|
|
HTTP/1.1 200
|
|
Vary: Origin
|
|
Vary: Access-Control-Request-Method
|
|
Vary: Access-Control-Request-Headers
|
|
Set-Cookie: XSRF-TOKEN=<token>; Path=/
|
|
X-Content-Type-Options: nosniff
|
|
X-XSS-Protection: 0
|
|
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
|
|
Pragma: no-cache
|
|
X-Frame-Options: DENY
|
|
|
|
# 2. POST with no token still fails, as it must.
|
|
HTTP/1.1 401
|
|
Vary: Origin
|
|
Vary: Access-Control-Request-Method
|
|
Vary: Access-Control-Request-Headers
|
|
X-Content-Type-Options: nosniff
|
|
X-XSS-Protection: 0
|
|
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
|
|
Pragma: no-cache
|
|
X-Frame-Options: DENY
|
|
Set-Cookie: JSESSIONID=<session>; Path=/; HttpOnly; SameSite=Lax
|
|
WWW-Authenticate: Basic realm="Realm", charset="UTF-8"
|
|
|
|
# 3. POST echoing the raw cookie value in X-XSRF-TOKEN.
|
|
HTTP/1.1 200
|
|
Vary: Origin
|
|
Vary: Access-Control-Request-Method
|
|
Vary: Access-Control-Request-Headers
|
|
X-Content-Type-Options: nosniff
|
|
X-XSS-Protection: 0
|
|
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
|
|
Pragma: no-cache
|
|
X-Frame-Options: DENY
|
|
|
|
{"created":true,"received":"{}","cookies":"XSRF-TOKEN"}
|
|
|
|
# Note the cookie attributes: Path=/ and nothing else. No SameSite, no Secure,
|
|
# no HttpOnly. A cookie with no SameSite attribute is treated as Lax, so a
|
|
# genuinely cross-site SPA still never receives it. See 12.
|