spring-projects / spring-projects/spring-security

Enabling CSRF on spring cloud gateway removes formData from POST requests and returns 400 Bad request error

Open
#11,687 7 comments 0 reactions 1 assignee View on GitHub

@sjohnr is already working on this.

Since Aug 11, 2022.

in: web type: bug
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Describe the bug
I have enabled CSRF on my spring cloud API gateway server. I have angular as my GUI framework which calls the rest services through the API gateway.
There are other underlying rest services after the API gateway. The spring cloud gateway acts a gatekeeper to all the requests to these rest services. These rest services are developed using spring web MVC.
I have used a custom filter to add the CSRF token to the response headers.
When the POST call is made I see that the formData is lost. So I always get 400 Bad request errors.
I disabled CSRF and the request goes through fine without any issues.

Looks like some filter is consuming the body and not forwarding it.

To Reproduce
Here is my sample project
https://github.com/manjosh1990/webgateway-issues
whenever the POST request is made, I get 400 bad request responses.

Expected behavior
The API should not consume the formData and pass it on to the underlying microservices.

Sample

Here is the link to the sample project: https://github.com/manjosh1990/webgateway-issues
I had raised a question on stackoverflow
https://stackoverflow.com/questions/73117195/csrf-on-spring-cloud-gateway-removing-formdata-from-post-requests-400-bad-reques?noredirect=1#comment129469661_73117195

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.