Implementing a simple web application using REST Api using Spring Boot Vaadin. Also, Security is connected in the project, a simple login with a login-password is carried out. Get() requests work fine, but a 403 "Forbidden" error occurs on PUT, POST, DELETE requests.

I tried disabling csrf using the http.httpBasic().and().csrf().disable() method, it does not help, and this is not recommended in production either.

I also tried adding to antMatchers() specifically a request type like this: http.httpBasic().and().authorizeRequests().antMatchers(HttpMethod.POST,"/**").permitAll(), also not helps.

Configuration class:

    @EnableWebSecurity
    @Configuration
    public class SecurityConfig extends VaadinWebSecurity {
    
   private static class SimpleInMemoryUserDetailsManager extends InMemoryUserDetailsManager {
            public SimpleInMemoryUserDetailsManager() {
                createUser(Manager.withUsername("manager1")
                        .password("{noop}123")
                        .roles(ROLE_MANAGER)
                        .build());
                createUser(Manager.withUsername("manager2")
                        .password("{noop}123")
                        .roles(ROLE_MANAGER)
                        .build());
            }
        }
    
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.httpBasic().and().authorizeRequests().antMatchers("/enterprises/\*\*").hasRole(ROLE_MANAGER);
    
            super.configure(http);
    
            setLoginView(http, LoginView.class);
        }
    
        @Bean
        public InMemoryUserDetailsManager enterprisesService() {
            return new SimpleInMemoryUserDetailsManager();
        }
    }

Rest-controller:

@org.springframework.web.bind.annotation.RestController
    @RequestMapping(path = "/")
    public class RestController {
    
        @Autowired
        private VehiclesRepository vehiclesRepository;
        @Autowired
        private EnterprisesRepository enterprisesRepository;
        @Autowired
        private DriversRepository driversRepository;
        @Autowired
        private ManagersRepository managersRepository;
    
        @GetMapping(
                path = "/vehicles",
                produces = "application/json")
        public VehiclesDto getVehicles() {
            VehiclesDto vehiclesDto = new VehiclesDto();
            for (Vehicle vehicle : vehiclesRepository.findAll()) {
                vehiclesDto.getVehicles().add(vehicle);
            }
            return vehiclesDto;
        }
    
        @GetMapping(
                path = "/enterprises",
                produces = "application/json")
       public @ResponseBody EnterprisesDto getEnterprises(@RequestParam("managerId") String managerId) {
            Manager manager = null;
            for (Manager managerFromRepo : managersRepository.findAll()) {
                if (managerFromRepo.getId().equals(Long.parseLong(managerId))) {
                    manager = managerFromRepo;
                    break;
                }
            }
            EnterprisesDto enterprisesDto = new EnterprisesDto();
            if (manager == null) return enterprisesDto;
            for (Enterprise enterprise : enterprisesRepository.findAll()) {
                if (manager.getEnterprises().contains(enterprise.getId()))
                    enterprisesDto.getEnterprises().add(enterprise);
            }
            return enterprisesDto;
        }
    
        @GetMapping(
                path = "/drivers",
                produces = "application/json")
        public DriversDto getDrivers() {
            DriversDto driversDto = new DriversDto();
            for (Driver driver : driversRepository.findAll()) {
                driversDto.getDrivers().add(driver);
            }
            return driversDto;
        }
    
        @PostMapping("/createVehicle")
        public @ResponseBody String createVehicle(@RequestBody String info) {
            return "it works!!!";
        }
    
        @DeleteMapping("/deleteVehicle")
        public @ResponseBody String deleteVehicle(){
            return "it works!!!";
        }
    }

Testing requests through Postman using Basic Authentication.

CodePudding user response：

You can disable CSRF just for your API:

http.csrf().ignoringRequestMatchers(new AntPathRequestMatcher("/enterprises/**"));