使用Vaadin使用Spring Security 403 CSRF令牌錯誤

Question

我試圖實現vaadin申請春季安全，但我有一個問題，登錄到頁面後，它讓我看到了一個錯誤：

{"status":403,"error":"Forbidden","message":"Could not verify the provided CSRF token because your session was not found.","path":"/"}

我嘗試很多事情，但他們沒有工作，這是我的標準安全配置類：

//SecurityConfig.java  
@Configuration 
@EnableWebSecurity 
public class SecurityConfig extends WebSecurityConfigurerAdapter { 

    @Autowired 
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
     auth 
      .inMemoryAuthentication() 
      .withUser("user") 
      .password("password") 
      .roles("USER"); 
    } 
} 

控制器類：

//HomeController.java 
@RestController 
public class HomeController { 

    @GetMapping("/") 
    public String index() { 
     return "Welcome to the home page!"; 
    } 

@GetMapping("/error") 
public String error(){ 
    return "Error!"; 
} 

}

而且Vaadin UI類

//VaadinUI.java 
@SpringUI 
public class VaadinUI extends UI { 
    VerticalLayout layout = new VerticalLayout(); 

    com.vaadin.ui.Label label = new com.vaadin.ui.Label("Witaj"); 

    @Autowired 
    public VaadinUI() {} 

    @Override 
    protected void init(VaadinRequest request) { 
     setContent(layout); 
     layout.addComponent(label); 
    } 

}

而且我的pom.xml

//pom.xml 
    <?xml version="1.0" encoding="UTF-8"?> 
    <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
     xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> 
     <modelVersion>4.0.0</modelVersion> 

     <groupId>example.com</groupId> 
     <artifactId>LDAPSpringInitializr</artifactId> 
     <version>0.0.1-SNAPSHOT</version> 
     <packaging>jar</packaging> 

     <name>LDAPSpringInitializr</name> 
     <description>Demo project for Spring Boot</description> 

     <parent> 
      <groupId>org.springframework.boot</groupId> 
      <artifactId>spring-boot-starter-parent</artifactId> 
      <version>1.5.3.RELEASE</version> 
      <relativePath/> <!-- lookup parent from repository --> 
     </parent> 

     <properties> 
      <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> 
      <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding> 
      <java.version>1.8</java.version> 
      <vaadin.version>8.0.5</vaadin.version> 
     </properties> 

     <dependencies> 
      <dependency> 
       <groupId>org.springframework.boot</groupId> 
       <artifactId>spring-boot-starter-data-jpa</artifactId> 
      </dependency> 
      <dependency> 
       <groupId>org.springframework.boot</groupId> 
       <artifactId>spring-boot-starter-data-ldap</artifactId> 
      </dependency> 
      <dependency> 
       <groupId>org.springframework.boot</groupId> 
       <artifactId>spring-boot-starter-security</artifactId> 
      </dependency> 
      <dependency> 
       <groupId>com.vaadin</groupId> 
       <artifactId>vaadin-spring-boot-starter</artifactId> 
      </dependency> 
      <dependency> 
       <groupId>org.springframework.boot</groupId> 
       <artifactId>spring-boot-starter-web</artifactId> 
      </dependency> 

      <dependency> 
       <groupId>org.postgresql</groupId> 
       <artifactId>postgresql</artifactId> 
       <scope>runtime</scope> 
      </dependency> 
      <dependency> 
       <groupId>org.springframework.boot</groupId> 
       <artifactId>spring-boot-starter-test</artifactId> 
       <scope>test</scope> 
      </dependency> 
     </dependencies> 

     <dependencyManagement> 
      <dependencies> 
       <dependency> 
        <groupId>com.vaadin</groupId> 
        <artifactId>vaadin-bom</artifactId> 
        <version>${vaadin.version}</version> 
        <type>pom</type> 
        <scope>import</scope> 
       </dependency> 
      </dependencies> 
     </dependencyManagement> 

     <build> 
      <plugins> 
       <plugin> 
        <groupId>org.springframework.boot</groupId> 
        <artifactId>spring-boot-maven-plugin</artifactId> 
       </plugin> 
      </plugins> 
     </build> 


    </project> 

如何使用Vaadin彈簧的安全性？ 我想在稍後將spring security與LDAP連接起來。

Answer 1

我沒那麼熟悉Vaadin，但這個帖子https://vaadin.com/blog/-/blogs/filter-based-spring-security-in-vaadin-applications表明Vaadin已經提供了CSRF保護，這樣你就可以通過

@Override 
protected void configure(final HttpSecurity httpSecurity) throws Exception { 
    httpSecurity.csrf().disable(); 
} 

在SecurityConfig春季禁用它。