Logout doesn't work after updating Spring Boot from 2.7 to 3.0.1 - spring-boot

Question

I have a Spring Boot application and the web security config looks like as follows:
#Configuration
#EnableWebSecurity(debug = false)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
#Autowired
private ClientRegistrationRepository clientRegistrationRepository;
#Override
protected void configure(HttpSecurity http) throws Exception {
http
// enables oauth2 login for any request
.authorizeRequests()
.anyRequest().authenticated()
.and()
.oauth2Login()
// configures logout adding an oidc logout success handler and invalidating the session on logout
.and()
.logout()
.logoutSuccessHandler(oidcLogoutSuccessHandler())
.invalidateHttpSession(true)
// adds security headers
.and()
.headers()
.addHeaderWriter(new StaticHeadersWriter("Referrer-Policy", "same-origin"))
.addHeaderWriter(new StaticHeadersWriter("Strict-Transport-Security", "max-age=31536000; includeSubDomains"))
// configures csrf
.and()
.csrf()
.csrfTokenRepository(getCookieCsrfTokenRepository());
}
#Bean
public WebSecurityCustomizer webSecurityCustomizer() {
// disables security for swagger ui and open api docs
return web -> web.ignoring().antMatchers("/**/health", "/swagger-ui/**", "/v3/**");
}
private CookieCsrfTokenRepository getCookieCsrfTokenRepository() {
CookieCsrfTokenRepository cookieCsrfTokenRepository = CookieCsrfTokenRepository.withHttpOnlyFalse();
cookieCsrfTokenRepository.setCookiePath("/");
return cookieCsrfTokenRepository;
}
private OidcClientInitiatedLogoutSuccessHandler oidcLogoutSuccessHandler() {
// configures the oidc logout success handler to redirect to the idp login page
OidcClientInitiatedLogoutSuccessHandler successHandler = new OidcClientInitiatedLogoutSuccessHandler(clientRegistrationRepository);
successHandler.setPostLogoutRedirectUri("{baseUrl}" + RouteConstants.IDP_LOGIN);
return successHandler;
}
}
After updating the Spring Boot version from 2.7 to 3.0.1 and doing according changes, the applications runs normally I can login successfully, but the logout doesn't work. The WebSecurityConfig class now looks like as follows:
#Configuration
#EnableWebSecurity(debug = false)
public class WebSecurityConfig {
#Autowired
private ClientRegistrationRepository clientRegistrationRepository;
#Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
// enables oauth2 login for any request
.authorizeHttpRequests()
.anyRequest().authenticated()
.and()
.oauth2Login()
// configures logout adding an oidc logout success handler and invalidating the session on logout
.and()
.logout()
.logoutSuccessHandler(oidcLogoutSuccessHandler())
.invalidateHttpSession(true)
// adds security headers
.and()
.headers()
.addHeaderWriter(new StaticHeadersWriter("Referrer-Policy", "same-origin"))
.addHeaderWriter(new StaticHeadersWriter("Strict-Transport-Security", "max-age=31536000; includeSubDomains"))
// configures csrf
.and()
.csrf()
.csrfTokenRepository(getCookieCsrfTokenRepository());
return http.build();
}
//The rest of the methods are the same
}
I added this property to make paths starting with /** work in a method webSecurityCustomizer()
spring.mvc.pathmatch.matching-strategy=ant-path-matcher
I noticed that the response cookie of http://localhost/api/v1/authentication/idp_login request doesn't contain XSRF-TOKEN, but before the update it was. Looking at the logs I am getting this error
org.springframework.security.web.FilterChainProxy - Securing POST /logout
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking DisableEncodeUrlFilter (1/15)
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking WebAsyncManagerIntegrationFilter (2/15)
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking SecurityContextHolderFilter (3/15)
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking HeaderWriterFilter (4/15)
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking CsrfFilter (5/15)
2023-01-21 DEBUG org.springframework.security.web.csrf.CsrfFilter - Invalid CSRF token found for http://localhost/api/v1/authentication/logout
2023-01-21 DEBUG org.springframework.security.web.access.AccessDeniedHandlerImpl - Responding with 403 status code
2023-01-21 TRACE org.springframework.security.web.header.writers.HstsHeaderWriter - Not injecting HSTS header since it did not match request to [Is Secure]
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Trying to match request against DefaultSecurityFilterChain [RequestMatcher=Mvc [pattern='/**/health'], Filters=[]] (1/4)
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Trying to match request against DefaultSecurityFilterChain [RequestMatcher=Mvc [pattern='/swagger-ui/**'], Filters=[]] (2/4)
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Trying to match request against DefaultSecurityFilterChain [RequestMatcher=Mvc [pattern='/v3/**'], Filters=[]] (3/4)
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Trying to match request against DefaultSecurityFilterChain [RequestMatcher=any request, Filters=[org.springframework.security.web.session.DisableEncodeUrlFilter#527fc8e, org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter#61bfc9bf, org.springframework.security.web.context.SecurityContextHolderFilter#3722c145, org.springframework.security.web.header.HeaderWriterFilter#7601bc96, org.springframework.security.web.csrf.CsrfFilter#33063f5b, org.springframework.security.web.authentication.logout.LogoutFilter#3291b443, org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRedirectFilter#707b1a44, org.springframework.security.oauth2.client.web.OAuth2LoginAuthenticationFilter#7132a9dc, org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter#424de326, org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter#2c7106d9, org.springframework.security.web.savedrequest.RequestCacheAwareFilter#2975a9e, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter#765ffb14, org.springframework.security.web.authentication.AnonymousAuthenticationFilter#329bad59, org.springframework.security.web.access.ExceptionTranslationFilter#33634f04, org.springframework.security.web.access.intercept.FilterSecurityInterceptor#53abfc07]] (4/4)
2023-01-21 DEBUG org.springframework.security.web.FilterChainProxy - Securing POST /error
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking DisableEncodeUrlFilter (1/15)
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking WebAsyncManagerIntegrationFilter (2/15)
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking SecurityContextHolderFilter (3/15)
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking HeaderWriterFilter (4/15)
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking CsrfFilter (5/15)
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking LogoutFilter (6/15)
2023-01-21 TRACE org.springframework.security.web.authentication.logout.LogoutFilter - Did not match request to Ant [pattern='/logout', POST]
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking OAuth2AuthorizationRequestRedirectFilter (7/15)
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking OAuth2LoginAuthenticationFilter (8/15)
2023-01-21 TRACE org.springframework.security.oauth2.client.web.OAuth2LoginAuthenticationFilter - Did not match request to Ant [pattern='/login/oauth2/code/*']
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking DefaultLoginPageGeneratingFilter (9/15)
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking DefaultLogoutPageGeneratingFilter (10/15)
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking RequestCacheAwareFilter (11/15)
2023-01-21 TRACE org.springframework.security.web.savedrequest.HttpSessionRequestCache - matchingRequestParameterName is required for getMatchingRequest to lookup a value, but not provided
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking SecurityContextHolderAwareRequestFilter (12/15)
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking AnonymousAuthenticationFilter (13/15)
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking ExceptionTranslationFilter (14/15)
2023-01-21 TRACE org.springframework.security.web.FilterChainProxy - Invoking FilterSecurityInterceptor (15/15)
2023-01-21 TRACE org.springframework.security.web.context.HttpSessionSecurityContextRepository - Retrieved SecurityContextImpl [Authentication=OAuth2AuthenticationToken [Principal=Name: [f:5f27139d-e373-4f94-885e-2771b67c493e:admin], Granted Authorities: [[OIDC_USER, SCOPE_email, SCOPE_openid, SCOPE_profile]], User Attributes: [{at_hash=IezFNMq7qXBpS499wXpjZg, sub=f:5f27139d-e373-4f94-885e-2771b67c493e:admin, email_verified=false, iss=http://localhost:80/idp/realms/products, typ=ID, preferred_username=admin, nonce=RpXazbXIYWDYNmAYJeX088axKakz0J-XpIq7KoYzHGs, platform={userId=db1ca9cc-da2e-4e6a-bd96-111111111111, username=admin, email=admin#fortra.tmp.com, tenantId=bf045e23-d197-4ba2-ba5b-1f1f275ac2cd, cpUserId=cp_user_id2}, sid=9a579605-b6aa-4267-91e9-d6cfde2bbc4d, aud=[cp], acr=1, azp=cp, auth_time=2023-01-21T19:54:16Z, exp=2023-01-21T19:59:17Z, session_state=9a579605-b6aa-4267-91e9-d6cfde2bbc4d, iat=2023-01-21T19:54:26Z, jti=7278704f-2b56-471a-9b11-ef017268de23}], Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=172.27.0.11, SessionId=9fa00c79-63cf-4528-bf1f-c0d358d9b655], Granted Authorities=[OIDC_USER, SCOPE_email, SCOPE_openid, SCOPE_profile]]] from SPRING_SECURITY_CONTEXT
2023-01-21 TRACE org.springframework.security.web.authentication.AnonymousAuthenticationFilter - Did not set SecurityContextHolder since already authenticated OAuth2AuthenticationToken [Principal=Name: [f:5f27139d-e373-4f94-885e-2771b67c493e:admin], Granted Authorities: [[OIDC_USER, SCOPE_email, SCOPE_openid, SCOPE_profile]], User Attributes: [{at_hash=IezFNMq7qXBpS499wXpjZg, sub=f:5f27139d-e373-4f94-885e-2771b67c493e:admin, email_verified=false, iss=http://localhost:80/idp/realms/products, typ=ID, preferred_username=admin, nonce=RpXazbXIYWDYNmAYJeX088axKakz0J-XpIq7KoYzHGs, platform={userId=db1ca9cc-da2e-4e6a-bd96-111111111111, username=admin, email=admin#fortra.tmp.com, tenantId=bf045e23-d197-4ba2-ba5b-1f1f275ac2cd, cpUserId=cp_user_id2}, sid=9a579605-b6aa-4267-91e9-d6cfde2bbc4d, aud=[cp], acr=1, azp=cp, auth_time=2023-01-21T19:54:16Z, exp=2023-01-21T19:59:17Z, session_state=9a579605-b6aa-4267-91e9-d6cfde2bbc4d, iat=2023-01-21T19:54:26Z, jti=7278704f-2b56-471a-9b11-ef017268de23}], Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=172.27.0.11, SessionId=9fa00c79-63cf-4528-bf1f-c0d358d9b655], Granted Authorities=[OIDC_USER, SCOPE_email, SCOPE_openid, SCOPE_profile]]
2023-01-21 TRACE org.springframework.security.web.access.intercept.FilterSecurityInterceptor - Did not re-authenticate OAuth2AuthenticationToken [Principal=Name: [f:5f27139d-e373-4f94-885e-2771b67c493e:admin], Granted Authorities: [[OIDC_USER, SCOPE_email, SCOPE_openid, SCOPE_profile]], User Attributes: [{at_hash=IezFNMq7qXBpS499wXpjZg, sub=f:5f27139d-e373-4f94-885e-2771b67c493e:admin, email_verified=false, iss=http://localhost:80/idp/realms/products, typ=ID, preferred_username=admin, nonce=RpXazbXIYWDYNmAYJeX088axKakz0J-XpIq7KoYzHGs, platform={userId=db1ca9cc-da2e-4e6a-bd96-111111111111, username=admin, email=admin#fortra.tmp.com, tenantId=bf045e23-d197-4ba2-ba5b-1f1f275ac2cd, cpUserId=cp_user_id2}, sid=9a579605-b6aa-4267-91e9-d6cfde2bbc4d, aud=[cp], acr=1, azp=cp, auth_time=2023-01-21T19:54:16Z, exp=2023-01-21T19:59:17Z, session_state=9a579605-b6aa-4267-91e9-d6cfde2bbc4d, iat=2023-01-21T19:54:26Z, jti=7278704f-2b56-471a-9b11-ef017268de23}], Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=172.27.0.11, SessionId=9fa00c79-63cf-4528-bf1f-c0d358d9b655], Granted Authorities=[OIDC_USER, SCOPE_email, SCOPE_openid, SCOPE_profile]] before authorizing
2023-01-21 TRACE org.springframework.security.web.access.intercept.FilterSecurityInterceptor - Authorizing filter invocation [POST /error] with attributes [authenticated]
2023-01-21 DEBUG org.springframework.security.web.access.intercept.FilterSecurityInterceptor - Authorized filter invocation [POST /error] with attributes [authenticated]
2023-01-21 TRACE org.springframework.security.web.access.intercept.FilterSecurityInterceptor - Did not switch RunAs authentication since RunAsManager returned null
2023-01-21 DEBUG org.springframework.security.web.FilterChainProxy - Secured POST /error
Do the other changes need to make it work?

Answer 1

I resolved the problem by adding csrfTokenRequestHandler like this
http.csrf().csrfTokenRequestHandler(getCsrfTokenRequestHandler())
private CsrfTokenRequestAttributeHandler getCsrfTokenRequestHandler() {
CsrfTokenRequestAttributeHandler requestHandler = new CsrfTokenRequestAttributeHandler();
// set the name of the attribute the CsrfToken will be populated on
requestHandler.setCsrfRequestAttributeName(null);
return request handler;
}
Still had another issue that x-xss-protection is 0 but should be "1; mode=block"