fixed csrf issues!

Author: rohithandique

build.gradle

@@ -71,7 +71,7 @@ tasks.named('bootRun') {
 		'-Dcom.sun.management.jmxremote.ssl=false',
 		'-Dcom.sun.management.jmxremote.authenticate=false',
 		'-Dcom.sun.management.jmxremote.rmi.port=9010',
-		'-Dspring.profiles.active=prod'
+		'-Dspring.profiles.active=local'
 	]
 }
 

src/main/java/com/generic/server/config/HttpConfig.java

@@ -2,17 +2,29 @@
 
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpMethod;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
+import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
+import org.springframework.security.web.csrf.CsrfTokenRequestAttributeHandler;
+
+import static com.generic.server.constants.Constants.*;
 
 @Configuration
 public class HttpConfig {
 
     @Bean
     public SecurityFilterChain localLoginAndRedirectFilterChain(HttpSecurity http) throws Exception {
-        http.csrf(csrf -> csrf.disable());
+
+        http.csrf(csrf -> csrf
+                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
+                .csrfTokenRequestHandler(new CsrfTokenRequestAttributeHandler())
+                .ignoringRequestMatchers(ACTUATOR_CSRF_EXCLUDED_PATHS)
+        );
         http.authorizeHttpRequests(authorize -> authorize
+                .requestMatchers(HttpMethod.GET, SWAGGER_PATHS).authenticated()
+                .requestMatchers("/actuator/**").hasAnyRole("ACTUATOR", "ADMIN")
                 .anyRequest().authenticated()
         );
         SavedRequestAwareAuthenticationSuccessHandler handler =
@@ -36,7 +48,7 @@ public void sendRedirect(
                 jakarta.servlet.http.HttpServletResponse response,
                 String url
         ) throws java.io.IOException {
-            String cleanedUrl = url.replace("?continue", "");
+            String cleanedUrl = url.replace("?continue", "").replace("&continue", "");
             delegate.sendRedirect(request, response, cleanedUrl);
         }
     }

src/main/java/com/generic/server/constants/Constants.java

@@ -0,0 +1,16 @@
+package com.generic.server.constants;
+
+public class Constants {
+
+    public static final String[] SWAGGER_PATHS = {
+            "/swagger-ui/**",
+            "/v3/api-docs/**"
+    };
+
+    public static final String[] ACTUATOR_CSRF_EXCLUDED_PATHS = {
+            "/actuator/hawtio/**",
+            "/actuator/jolokia/**",
+            "/actuator/shutdown"
+    };
+
+}

src/main/resources/application-local.yml

@@ -2,14 +2,18 @@ management:
   endpoints:
     web:
       exposure:
-        include: "health,info,hawtio,jolokia,prometheus"
+        include: "*"
     health:
       show-details: when_authorized
 
 hawtio:
   authenticationEnabled: false
 
 spring:
+  servlet:
+    session:
+      cookie:
+        same-site: strict
   security:
     user:
       name: "devuser"

src/main/resources/application-prod.yml

@@ -2,16 +2,23 @@ management:
   endpoints:
     web:
       exposure:
-        include: "health,info,hawtio,jolokia,prometheus"
+        include: "health,info,hawtio,prometheus"
     health:
       show-details: when_authorized
+  endpoint:
+    shutdown:
+      enabled: false
 
 hawtio:
   authenticationEnabled: true
 
 spring:
   devtools:
     add-properties: false
+  servlet:
+    session:
+      cookie:
+        same-site: strict
 
 logging:
   level:

src/test/java/com/generic/server/config/HttpConfigTest.java

@@ -17,7 +17,7 @@ void sendRedirect_withContinue_removesIt() throws IOException {
         strategy.delegate = delegate;
         var request = mock(jakarta.servlet.http.HttpServletRequest.class);
         var response = mock(jakarta.servlet.http.HttpServletResponse.class);
-        var url = "http://localhost:8080/some/path?continue";
+        var url = "http://localhost:8080/some/path?continue&continue";
 
         // Act
         strategy.sendRedirect(request, response, url);