55 lines
2.0 KiB
Plaintext
55 lines
2.0 KiB
Plaintext
==============================================================================
|
|
docs/output/08-csrf-naive.txt
|
|
CookieCsrfTokenRepository.withHttpOnlyFalse() on its own - the recipe from every pre-6.0
|
|
tutorial. Three separate things go wrong.
|
|
Profile: csrfnaive
|
|
==============================================================================
|
|
|
|
# 1. The bootstrap GET. A SPA expects an XSRF-TOKEN cookie here.
|
|
HTTP/1.1 200
|
|
Vary: Origin
|
|
Vary: Access-Control-Request-Method
|
|
Vary: Access-Control-Request-Headers
|
|
X-Content-Type-Options: nosniff
|
|
X-XSS-Protection: 0
|
|
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
|
|
Pragma: no-cache
|
|
X-Frame-Options: DENY
|
|
|
|
# cookie jar after the GET:
|
|
(empty - no cookie was set)
|
|
|
|
# 2. POST with no token.
|
|
HTTP/1.1 401
|
|
Vary: Origin
|
|
Vary: Access-Control-Request-Method
|
|
Vary: Access-Control-Request-Headers
|
|
Set-Cookie: XSRF-TOKEN=<token>; Path=/
|
|
X-Content-Type-Options: nosniff
|
|
X-XSS-Protection: 0
|
|
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
|
|
Pragma: no-cache
|
|
X-Frame-Options: DENY
|
|
Set-Cookie: JSESSIONID=<session>; Path=/; HttpOnly; SameSite=Lax
|
|
WWW-Authenticate: Basic realm="Realm", charset="UTF-8"
|
|
|
|
# cookie jar now:
|
|
|
|
localhost | FALSE | / | FALSE | 0 | XSRF-TOKEN | 4888debb-2e51-4742-b0e7-262c489825b9
|
|
|
|
# 3. POST echoing the raw cookie value back in X-XSRF-TOKEN, which is what every
|
|
# SPA snippet on the internet does.
|
|
HTTP/1.1 401
|
|
Vary: Origin
|
|
Vary: Access-Control-Request-Method
|
|
Vary: Access-Control-Request-Headers
|
|
X-Content-Type-Options: nosniff
|
|
X-XSS-Protection: 0
|
|
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
|
|
Pragma: no-cache
|
|
X-Frame-Options: DENY
|
|
WWW-Authenticate: Basic realm="Realm", charset="UTF-8"
|
|
|
|
<timestamp> DEBUG <pid> --- [cors-csrf-samesite] [nio-8080-exec-N] o.s.security.web.csrf.CsrfFilter : Invalid CSRF token found for http://localhost:8080/api/data
|
|
<timestamp> DEBUG <pid> --- [cors-csrf-samesite] [nio-8080-exec-N] o.s.security.web.csrf.CsrfFilter : Invalid CSRF token found for http://localhost:8080/api/data
|