Why is form login principal null inside an Iframe? - spring

Question

I am trying to enable my Spring Boot website within an iframe. I have security config, request filter, form login and OAuth2. My form login works well from browser but as soon as I logged in from iframe I can see JSESSIONID is null for the same users logged in from browser.
Log for iframe:
UsernamePasswordAuthenticationToken [Principal=test#example.com, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=0:0:0:0:0:0:0:1, SessionId=null], Granted Authorities=[ROLE_USER]]
Log for browser:
[Authentication=UsernamePasswordAuthenticationToken [Principal=test#example.com, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=0:0:0:0:0:0:0:1, SessionId=04E5DB0982A859E5C215294EF96814FD], Granted Authorities=[ROLE_MANAGER, ROLE_USER]]]
Below is my security config:
#Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.csrf().disable()
.cors().disable()
.authorizeHttpRequests(authorize -> authorize
.requestMatchers("/app_resources/**", "/signup", "/favicon.ico", "/login", "/logout", "/signup",
"/oauth2/authorization/**", "/pages/**", "/login/oauth2/code/**", "/login/oauth2/code/**",
"/product/authenticate", "/cdnjs.cloudflare.com/**").permitAll()
.requestMatchers("/admin/**").hasRole("ADMIN")
.anyRequest().authenticated()
)
.addFilterBefore(securityFilter, UsernamePasswordAuthenticationFilter.class)
.formLogin(form -> form
.loginPage("/auth")
.defaultSuccessUrl("/index")
.failureHandler(authenticationfailure())
.successHandler(new AuthSuccessHandler()).permitAll()
)
.logout(out -> out
.logoutUrl("/logout")
)
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
.and()
.authenticationProvider(authProvider())
.oauth2Login()
.loginPage("/auth")
.defaultSuccessUrl("/homesuccess")
.successHandler(new AuthSuccessHandler());
http
.headers()
.frameOptions().disable();
return http.build();
}
Below is my AuthenticationSuccesHandler:
#Override
public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
Authentication authentication) throws IOException, ServletException {
System.out.println("onAuthenticationSuccess >>>>>>>>>>>>>>"+authentication.toString());
request.getSession(false).setMaxInactiveInterval(604800);
RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
redirectStrategy.sendRedirect(request, response, "/");
}
Not really sure what went wrong inside an iframe. I can see my login page, I can see the user password token object in AuthennticationSuccessHandler but after redirecting it to dashboard suddenly principal object becomes null in security filter.
MVC config:
#EnableWebMvc
#Configuration
public class MvcConfig implements WebMvcConfigurer{
#Override
public void addResourceHandlers(ResourceHandlerRegistry registry) {
VersionResourceResolver versionResolver = new VersionResourceResolver().addContentVersionStrategy("/**/*.js",
"/**/*.css", "/**/*.png");
registry.addResourceHandler("/app_resources/**", "/favicon.ico", "/firebase-messaging-sw.js", "/manifest.json",
"/salesken.png")
.addResourceLocations("/assets/js/",
"/assets/css/","/assets/img/","/")
.setCacheControl(CacheControl.maxAge(1, TimeUnit.MINUTES)).resourceChain(true)
.addResolver(versionResolver);
}
#Override
public void configureContentNegotiation(ContentNegotiationConfigurer configurer) {
configurer.defaultContentType(MediaType.APPLICATION_JSON);
}
#Bean
public ViewResolver viewResolver() {
InternalResourceViewResolver bean = new InternalResourceViewResolver();
bean.setPrefix("pages/");
bean.setSuffix(".jsp");
return bean;
}
}
Even when I am trying to put authentication object in session, this object is not set and its value is null in the request filter.

Answer 1

Chrome uses 'Lax' as the default same-site cookie policy. This prevents the browser for using the cookie in the iFrame.
To fix this by setting the SameSite flag to none with Spring Boot 2.5.0 on, add the following:
import org.springframework.boot.web.servlet.server.CookieSameSiteSupplier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
#Configuration(proxyBeanMethods = false)
public class SameSiteNoneConfiguration {
#Bean
public CookieSameSiteSupplier applicationCookieSameSiteSupplier() {
return CookieSameSiteSupplier.ofNone();
}
}
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-web</artifactId>
</dependency>
Only works with https because the cookie must be secure. Spring Boot session cookies are already httpOnly.
Spring Boot pre-2.5.0 does not have a CookieSameSiteSupplier so the following must be created. Requires Spring Boot v2.1.0.RELEASE and up.
#Component
#AllArgsConstructor
public class SameSiteInjector {
private final ApplicationContext applicationContext;
#EventListener
public void onApplicationEvent(ContextRefreshedEvent event) {
DefaultCookieSerializer cookieSerializer = applicationContext.getBean(DefaultCookieSerializer.class);
cookieSerializer.setSameSite("none");
}
}
with the following dependency:
<dependency>
<groupId>org.springframework.session</groupId>
<artifactId>spring-session-core</artifactId>
</dependency>
To do this on Tomcat - from 8.5.42+. Edit %TOMCAT_HOME%/conf/context.xml, update CookieProcessor element on following lines say for setting SameSiteCookies in HTTP response headers's set-cookie.
<CookieProcessor className="org.apache.tomcat.util.http.LegacyCookieProcessor" sameSiteCookies="none" />
Because you are editing %TOMCAT_HOME%/conf/context.xml it will do this for all installed webapps. To avoid this you need to hack the META-INF folder and create a context.xml and put the above snippet within.