spring-projects / spring-projects/spring-data-rest
HAL browser not working behind zuul with csrf protection [DATAREST-980]
Open
@odrotbohm is already working on this.
Since Dec 31, 2020.
type: bug
- Dominant language
- Java
- Stars
- 958
- Forks
- 568
- PR merge metrics
- No merged PRs in 30d
Description
Javier Alejandro Miño opened DATAREST-980 and commented
When I run the HAL browser behind a Zuul proxy that has a csrf protection the post request fail due to the following:
{
"timestamp": 1484401944482,
"status": 403,
"error": "Forbidden",
"message": "Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-XSRF-TOKEN'.",
"path": "/office-league/heroes"
}
This should be very easy to solve by adding to CustomPostForm.js the capabilitie to send a header ```
X-XSRF-TOKEN
```XSRF-TOKEN
``` is present.
I attached a pull request please let me know if something needs to be updated or changed.
Affects: 2.5.6 (Hopper SR6)
Referenced from: pull request https://github.com/spring-projects/spring-data-rest/pull/253
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.