spring-projects / spring-projects/spring-security
Enabling CSRF on spring cloud gateway removes formData from POST requests and returns 400 Bad request error
@sjohnr is already working on this.
Since Aug 11, 2022.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
I have enabled CSRF on my spring cloud API gateway server. I have angular as my GUI framework which calls the rest services through the API gateway.
There are other underlying rest services after the API gateway. The spring cloud gateway acts a gatekeeper to all the requests to these rest services. These rest services are developed using spring web MVC.
I have used a custom filter to add the CSRF token to the response headers.
When the POST call is made I see that the formData is lost. So I always get 400 Bad request errors.
I disabled CSRF and the request goes through fine without any issues.
Looks like some filter is consuming the body and not forwarding it.
To Reproduce
Here is my sample project
https://github.com/manjosh1990/webgateway-issues
whenever the POST request is made, I get 400 bad request responses.
Expected behavior
The API should not consume the formData and pass it on to the underlying microservices.
Sample
Here is the link to the sample project: https://github.com/manjosh1990/webgateway-issues
I had raised a question on stackoverflow
https://stackoverflow.com/questions/73117195/csrf-on-spring-cloud-gateway-removing-formdata-from-post-requests-400-bad-reques?noredirect=1#comment129469661_73117195
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.