What I have:
What I need:
What I tried
server.servlet.session.cookie.same-site= none
property, but it only affect to JSESSIONID cookie. It didn`t work with csrf cookie.Set-cookie
, but then, I lost the set-cookie header of JSESSIONID cookie.¿What i can do to get csrf cookie samesite=none? ¿Is there other solution to run csrf authentication in chrome with diferents domains?
Thanks in advance
I found the solution
CookieCsrfTokenRepository
using setCookieCustomizer
metohd with a Consumer<ResponseCookie.ResponseCookieBuilder>
CookieCsrfTokenRepository tokenRepository = new CookieCsrfTokenRepository();
tokenRepository.setCookieCustomizer(new Consumer<ResponseCookie.ResponseCookieBuilder>() {
@Override
public void accept(ResponseCookieBuilder t) {
t.sameSite("none");
t.secure(true);
t.httpOnly(false); //Js can read
}
});
filterChain(HttpSecurity http)
method:
@Configuration
@EnableWebSecurity
public class SecurityJavaConfig {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
//Configuramos el Csrf Token repository para tener una cookie cross domnain
CookieCsrfTokenRepository tokenRepository = new CookieCsrfTokenRepository();
tokenRepository.setCookieCustomizer(new Consumer<ResponseCookie.ResponseCookieBuilder>() {
@Override
public void accept(ResponseCookieBuilder t) {
t.sameSite(csrfSameSiteCookie);
t.secure(csrfSecureCookie);
t.httpOnly(false); //Para que js pueda leer la cookie
}
});
http
.cors((cors) -> cors.configurationSource(corsConfigurationSource()))
.csrf((csrf) -> csrf
.csrfTokenRepository(tokenRepository)
)
.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.ALWAYS))
//Autorizaciones end-points
.authorizeHttpRequests((authorize) -> authorize
.requestMatchers(HttpMethod.OPTIONS,"/**").permitAll()
.requestMatchers(HttpMethod.GET,"/csrf").permitAll()
.anyRequest().authenticated()
)
.httpBasic(withDefaults());;
return http.build();
}
}