BAEL-4792 Stateless REST API and CSRF (#11398)

* Scan package for controller
Migrate deprecated Spring config

* BAEL-4792: enable CSRF + sample REST API request

* Adjust CSRF logs

spring-security-modules/spring-security-web-react/src/main/java/com/baeldung/spring/MvcConfig.java

@@ -1,18 +1,20 @@
 package com.baeldung.spring;
 
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.ComponentScan;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.servlet.ViewResolver;
 import org.springframework.web.servlet.config.annotation.EnableWebMvc;
 import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
 import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
-import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 import org.springframework.web.servlet.view.InternalResourceViewResolver;
 import org.springframework.web.servlet.view.JstlView;
 
 @EnableWebMvc
 @Configuration
-public class MvcConfig extends WebMvcConfigurerAdapter {
+@ComponentScan(basePackages = { "com.baeldung.spring" })
+public class MvcConfig implements WebMvcConfigurer {
 
     public MvcConfig() {
         super();
@@ -22,8 +24,6 @@ public class MvcConfig extends WebMvcConfigurerAdapter {
 
     @Override
     public void addViewControllers(final ViewControllerRegistry registry) {
-        super.addViewControllers(registry);
-
         registry.addViewController("/anonymous.html");
 
         registry.addViewController("/login.html");
@@ -35,7 +35,7 @@ public class MvcConfig extends WebMvcConfigurerAdapter {
     @Override
     public void addResourceHandlers(ResourceHandlerRegistry registry) {
         registry.addResourceHandler("/static/**").addResourceLocations("/WEB-INF/view/react/build/static/");
-
+        
         registry.addResourceHandler("/*.js").addResourceLocations("/WEB-INF/view/react/build/");
         registry.addResourceHandler("/*.json").addResourceLocations("/WEB-INF/view/react/build/");
         registry.addResourceHandler("/*.ico").addResourceLocations("/WEB-INF/view/react/build/");

spring-security-modules/spring-security-web-react/src/main/java/com/baeldung/spring/RestController.java

@@ -0,0 +1,31 @@
+package com.baeldung.spring;
+import javax.servlet.http.HttpServletRequest;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.web.csrf.CsrfToken;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+@Controller
+@RequestMapping("/rest")
+public class RestController {
+
+  private static final Logger LOGGER = LoggerFactory.getLogger(RestController.class);
+
+  @GetMapping
+  public ResponseEntity<Void> get(HttpServletRequest request) {
+    CsrfToken token = (CsrfToken) request.getAttribute("_csrf");
+    LOGGER.info("{}={}", token.getHeaderName(), token.getToken());
+    return ResponseEntity.ok().build();
+  }
+  
+  @PostMapping
+  public ResponseEntity<Void> post(HttpServletRequest request) {
+    // Same impl as GET for testing purpose
+    return this.get(request);
+  }
+}

spring-security-modules/spring-security-web-react/src/main/java/com/baeldung/spring/SecSecurityConfig.java

@@ -7,6 +7,7 @@ import org.springframework.security.config.annotation.authentication.builders.Au
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
 
 @Configuration
 @EnableWebSecurity
@@ -21,11 +22,11 @@ public class SecSecurityConfig extends WebSecurityConfigurerAdapter {
     protected void configure(final AuthenticationManagerBuilder auth) throws Exception {
         // @formatter:off
         auth.inMemoryAuthentication()
-        .withUser("user1").password("user1Pass").roles("USER")
+        .withUser("user1").password("{noop}user1Pass").roles("USER")
         .and()
-        .withUser("user2").password("user2Pass").roles("USER")
+        .withUser("user2").password("{noop}user2Pass").roles("USER")
         .and()
-        .withUser("admin").password("admin0Pass").roles("ADMIN");
+        .withUser("admin").password("{noop}admin0Pass").roles("ADMIN");
         // @formatter:on
     }
 
@@ -33,11 +34,11 @@ public class SecSecurityConfig extends WebSecurityConfigurerAdapter {
     protected void configure(final HttpSecurity http) throws Exception {
         // @formatter:off
         http
-        .csrf().disable()
+        .csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()).and()
         .authorizeRequests()
         .antMatchers("/admin/**").hasRole("ADMIN")
         .antMatchers("/anonymous*").anonymous()
-        .antMatchers(HttpMethod.GET, "/index*", "/static/**", "/*.js", "/*.json", "/*.ico").permitAll()
+        .antMatchers(HttpMethod.GET, "/index*", "/static/**", "/*.js", "/*.json", "/*.ico", "/rest").permitAll()
         .anyRequest().authenticated()
         .and()
         .formLogin()