And also, what does applicationContext-filter look like?
You should also ensure that in your site's web.xml, applicationContext-rest-api.xml is included in the list of patchConfigLocations
above applicationContext-security.xml. That applicationContext-rest-api.xml excludes the blCsrfFilter for all paths that start with /api/:
Code: Select all
<!-- Set up Spring security for the RESTful API -->
<sec:http pattern="/api/**" create-session="stateless">
<sec:http-basic />
<sec:custom-filter ref="blRestPreSecurityFilterChain" before="CHANNEL_FILTER"/>
<sec:custom-filter ref="blRestCustomerStateFilter" after="REMEMBER_ME_FILTER"/>
<sec:custom-filter ref="blRestPostSecurityFilterChain" after="SWITCH_USER_FILTER"/>
</sec:http>
If you do not have that piece, then Spring Security will throw in the blCsrfFilter into the security filter chain which is required for the site but should be excluded in the Rest APIs. From applicationContext-security.xml:
Code: Select all
<sec:http auto-config="false" authentication-manager-ref="blAuthenticationManager" disable-url-rewriting="true">
<!-- We handle session fixation protection ourselves -->
<sec:session-management session-fixation-protection="none" />
<!-- .................................. -->
<!-- Other configuration excluded -->
<!-- .................................. -->
<!-- Specify our custom filters -->
<sec:custom-filter ref="blPreSecurityFilterChain" before="CHANNEL_FILTER"/>
<sec:custom-filter ref="blCsrfFilter" before="FORM_LOGIN_FILTER"/>
<sec:custom-filter ref="blSessionFixationProtectionFilter" before="SESSION_MANAGEMENT_FILTER"/>
<sec:custom-filter ref="blPostSecurityFilterChain" after="SWITCH_USER_FILTER"/>
</sec:http>