I am uploading a CSV file on JSP page with Spring security but on uploading it is showing "Unauthorised access page error 403 page" - spring

Question

My spring security configuration is as follows:
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:mvc="http://www.springframework.org/schema/mvc"
xsi:schemaLocation="http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
<debug/>
<http auto-config="true" use-expressions="true" disable-url-rewriting="true" >
<!-- RESOURCES -->
<intercept-url pattern="/pages/login/login.jsp" access="permitAll" />
<intercept-url pattern="/login*" access="isAuthenticated()" />
<intercept-url pattern="/pages/login*" access="permitAll" />
<intercept-url pattern="/pages/user*" access="hasAnyRole('ADMIN')" />
<intercept-url pattern="/user**" access="hasAnyRole('ADMIN')" />
<intercept-url pattern="/new.version**" access="hasAnyRole('ADMIN')" />
<intercept-url pattern="/pages/version**" access="hasAnyRole('ADMIN','OPERATIONS')" />
<intercept-url pattern="/ver.htm?method=**" access="hasAnyRole('ADMIN','OPERATIONS')" />
<intercept-url pattern="/rep.htm?method=**" access="hasAnyRole('ADMIN','OPERATIONS')" />
<intercept-url pattern="/upload.htm?method=**" access="hasAnyRole('ADMIN','OPERATIONS')" />
<intercept-url pattern="/pages/rep**" access="hasAnyRole('ADMIN','OPERATIONS')" />
<intercept-url pattern="/pages/upload**" access="hasAnyRole('ADMIN','OPERATIONS')" />
<intercept-url pattern="/css/**" access="permitAll" />
<intercept-url pattern="/js/**" access="permitAll" />
<intercept-url pattern="/image/**" access="permitAll" />
<intercept-url pattern="/images/**" access="permitAll" />
<intercept-url pattern="/include/**" access="permitAll" />
<intercept-url pattern="/**" access="isAuthenticated()" />
<!-- <intercept-url pattern="/images/**" access="permitAll" /> -->
<custom-filter ref="requestParamEncodingFilter" after="FILTER_SECURITY_INTERCEPTOR"/>
<form-login
login-page="/pages/login/login.jsp"
default-target-url="/login.htm?method=login"
username-parameter="j_username"
password-parameter="j_password"
authentication-failure-url="/pages/login/login.jsp?login_error=1"
/>
<logout logout-success-url="/pages/login/login.jsp" invalidate-session="true" delete-cookies="JSESSIONID" />
<session-management session-fixation-protection="newSession" invalid-session-url="/pages/login/login.jsp" />
<csrf/> //csrf is enabled here
<headers>
<cache-control/>
<xss-protection/>
<frame-options policy="SAMEORIGIN"/>
</headers>
</http>
<authentication-manager>
<authentication-provider ref="customAuthProvider"/>
</authentication-manager>
<mvc:interceptors>
<mvc:interceptor>
<mvc:mapping path="/**"/>
<beans:bean class="com.test.component.security.MyInterceptor"/>
</mvc:interceptor>
</mvc:interceptors>
<beans:bean class="com.test.component.security.RequestParamEncodingFilter" id="requestParamEncodingFilter"/>
I am uploading a CSV file on JSP page and I have used Spring security but on uploading it is showing Unauthorised access page error 403 page when my csrf tag is enabled in spring security configuration. If I disable it my file is successfully uploaded.

Answer 1

No need to put csrf tag
Since it is enabled by default if you are using spring 4
As of Spring Security 4.0, CSRF protection is enabled by default with XML configuration.
Check the link.
for spring 3 check link