Adding Spring Data REST prevents CsrfTokenArgumentResolver [DATAREST-656]

Rob Winch opened DATAREST-656 and commented

In a standard Spring MVC controller adding Spring Data REST causes Spring Security's to be ignored CsrfTokenArgumentResolver. The problem is that ProxyingHandlerMethodArgumentResolver is registered first which will intercept any interface.

The issue can be worked around by using the following:

@Configuration
@Order(Ordered.HIGHEST_PRECEDENCE   )
public class MvcConfig extends WebMvcConfigurerAdapter {

    @Override
    public void addArgumentResolvers(
            List<HandlerMethodArgumentResolver> argumentResolvers) {
        argumentResolvers.add(new CsrfTokenArgumentResolver());
    }
}

You can see a sample at https://github.com/rwinch/spring-state-securing-restful-apis/tree/DATAREST-656 by running SpringSessionApplicationTests.

Reference URL: https://github.com/rwinch/spring-state-securing-restful-apis/tree/DATAREST-656

Issue Links:

• DATAREST-657 Unable to resolve PersistentEntityResourceAssembler