SpringMVC with rest controller - Request method 'POST' not supported - spring

Question

I have application in SpringMVC with Spring Security. In spring security xml configuration file i enable csrf using <csrf/>. View in html work properly when i add csrf token to link in form but now i want add Controller and made some rest communication. Controller looks like this:
#Controller
public class RestControllerTest {
#RequestMapping(value = "/rest", method = RequestMethod.POST, produces = "application/json")
#ResponseStatus(value = HttpStatus.OK)
public #ResponseBody void setUser(#RequestBody User user){
System.out.println("Witaj " + user.getFirstname() + "!");
}
}
When i try to send JSon with user (using postman):
{
"firstname": "name",
"lastname": "name"
}
I get 404 not found status in postman and WARN : org.springframework.web.servlet.PageNotFound - Request method 'POST' not supported in STS. I know that I have to use csrf token but i don't have idea how to do this.

Answer 1

I have a similar working usecase as yours. This is how things look like in my case.
My Filter class -
public class MyCsrfFilter extends OncePerRequestFilter {
#Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
FilterChain filterChain)
throws Exception {
CsrfToken csrf = (CsrfToken) request.getAttribute(org.springframework.security.web.csrf.CsrfToken.class.getName());
if (csrf != null) {
Cookie cookie = WebUtils.getCookie(request, "XSRF-TOKEN");
String token = csrf.getToken();
if (cookie == null) {
cookie = new Cookie("XSRF-TOKEN", token);
cookie.setPath(YOUR_DOMAIN_NAME);
cookie.setHttpOnly(true);
response.addCookie(cookie);
}
}
filterChain.doFilter(request, response);
}
}
Below is the security configuration in spring-boot. You can convert it to equivalent xml config file if you need one.
#Configuration
#EnableWebMvcSecurity
public class CustomWebSecurityConfiguration extends WebSecurityConfigurerAdapter {
#Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf()
.csrfTokenRepository(getTokenRepo())
.and()
.authorizeRequests()
.antMatchers("/login", "/login**").permitAll()
.and()
.addFilterAfter(new CsrfHeaderFilter(), CsrfFilter.class);
}
private CsrfTokenRepository getTokenRepo() {
HttpSessionCsrfTokenRepository repo = new HttpSessionCsrfTokenRepository();
repo.setHeaderName("X-XSRF-TOKEN");
return repo;
}
Hope this helps !