spring-bootspring-securitycsrfsamesitecross-site

SpringBoot - How I can configure samesite none Csrf Cookie (Spring Security 6.2)


What I have:

What I need:

What I tried

¿What i can do to get csrf cookie samesite=none? ¿Is there other solution to run csrf authentication in chrome with diferents domains?

Thanks in advance


Solution

  • I found the solution

    1. First, create a custom CookieCsrfTokenRepository using setCookieCustomizer metohd with a Consumer<ResponseCookie.ResponseCookieBuilder>
            CookieCsrfTokenRepository tokenRepository = new CookieCsrfTokenRepository();
            tokenRepository.setCookieCustomizer(new Consumer<ResponseCookie.ResponseCookieBuilder>() {
                
                @Override
                public void accept(ResponseCookieBuilder t) {
                    t.sameSite("none");
                    t.secure(true);
                    t.httpOnly(false); //Js can read
                }
            });
    
    
    1. Apply at filterChain(HttpSecurity http) method:
    
    @Configuration
    @EnableWebSecurity
    public class SecurityJavaConfig {
    @Bean
        public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
            
            //Configuramos el Csrf Token repository para tener una cookie cross domnain
            CookieCsrfTokenRepository tokenRepository = new CookieCsrfTokenRepository();
            tokenRepository.setCookieCustomizer(new Consumer<ResponseCookie.ResponseCookieBuilder>() {
                
                @Override
                public void accept(ResponseCookieBuilder t) {
                    t.sameSite(csrfSameSiteCookie);
                    t.secure(csrfSecureCookie);
                    t.httpOnly(false); //Para que js pueda leer la cookie
                }
            });        
            
            http
                .cors((cors) -> cors.configurationSource(corsConfigurationSource()))
                .csrf((csrf) -> csrf
                        .csrfTokenRepository(tokenRepository)
                )
                .sessionManagement(session  -> session.sessionCreationPolicy(SessionCreationPolicy.ALWAYS))
                //Autorizaciones end-points
                .authorizeHttpRequests((authorize) -> authorize
                        .requestMatchers(HttpMethod.OPTIONS,"/**").permitAll()
                        .requestMatchers(HttpMethod.GET,"/csrf").permitAll()
                        .anyRequest().authenticated()
                )
                .httpBasic(withDefaults());;
    
     
            return http.build();
        }
    }