spring - File Upload (multipart) is not working with Zuul Proxy -
i using spring security spring boot , angular js.
in application, every request redirecting gateway app other apps using zuul proxy. file upload module not working in architecture. file upload javascript code below:
if(idprooffile.files.length == 0) { $scope.alerts = [ { type: 'danger', msg: 'no file(s) selected, please browse , select id proof file(s) first.' }, ]; return; } else{ // upload user's files:: //create form data send via post var formdata = new formdata(); for(var i=0; i< idprooffile.files.length; i++){ if(idprooffile.files[i].size > 31457280) // check each file size should not more 30 mb = 30*1024*1024 bytes { $scope.alerts = [ { type: 'danger', msg: 'the size of file: '+ idprooffile.files[i].name +' more 30 mb. max limit of file size 30 mb.'} ]; return; } else{ var extension = idprooffile.files[i].name.substr(idprooffile.files[i].name.lastindexof('.') + 1).tolowercase(); //alert(extension); if (idprooffile.files[i].name.length > 0) { if (allowedextensions.indexof(extension) === -1) { $scope.alerts = [ { type: 'danger', msg: 'only pdf files allowed. selected file:- '+ idprooffile.files[i].name +' .'+extension+' file.'} ]; return; } } } formdata.append("idproof",idprooffile.files[i]); } var request = new xmlhttprequest(); request.open('post', 'resource/upload_id_proof/' +$rootscope.loggedinuserprimarykeyid+'/'+$rootscope.loggedinuserid, false); request.send(formdata); the spring security code below:
@override public void configure(websecurity web) throws exception { web .ignoring() .antmatchers("/update_new_user/**"); } @override protected void configure(httpsecurity http) throws exception { http.httpbasic().and().authorizerequests() //.antmatchers("/index.html", "/", "/login", "/message", "/home") //.antmatchers("/index.html", "/", "/login", "/message", "/home", "/css", "/font-awesome/**", "/fonts", "/img/**", "/js/**", "/less", "/mail").permitall() .antmatchers("/index.html", "/", "/css/**", "/font-awesome/**", "/fonts", "/img/**", "/js/**", "/less", "/mail").permitall() //.antmatchers("/ui/", "/ui/public/js/**", "/ui/js/**").permitall() .antmatchers("/ui/public/**").hasanyauthority("admin", "superadmin", "owner", "tenant") .antmatchers("/ui/private/projectadmin/**").hasauthority("admin") .antmatchers("/ui/private/superadmin/**").hasauthority("superadmin") .antmatchers("/ui/private/owner/**").hasauthority("owner") .antmatchers("/ui/private/tenant/**").hasauthority("tenant") .anyrequest().authenticated() .and() .csrf() .csrftokenrepository(csrftokenrepository()).and() .addfilterafter(csrfheaderfilter(), csrffilter.class); } private filter csrfheaderfilter() { return new onceperrequestfilter() { @override protected void dofilterinternal(httpservletrequest request, httpservletresponse response, filterchain filterchain) throws servletexception, ioexception { csrftoken csrf = (csrftoken) request.getattribute(csrftoken.class .getname()); if (csrf != null) { cookie cookie = webutils.getcookie(request, "xsrf-token"); string token = csrf.gettoken(); if (cookie == null || token != null && !token.equals(cookie.getvalue())) { cookie = new cookie("xsrf-token", token); cookie.setpath("/"); response.addcookie(cookie); } } filterchain.dofilter(request, response); } }; } the controller code below:
@requestmapping(value="/upload_id_proof/{userprimarykeyid}/{userid}", method = requestmethod.post) public @responsebody string uploadidproof( //@requestparam(value = "infoclient") string infoclientstring, @requestparam(value = "idproof") multipartfile[] idprooffiles, @pathvariable long userprimarykeyid, @pathvariable string userid) { the request failing @ 'gateway' application while redirecting request 'resource' application. exception @ 'gateway' app below:
**invalid csrf token found localhost:8080/resource/upload_id_proof/40/11** detailed logs:
2016-04-29 10:00:05.797 debug 6020 --- [nio-8080-exec-1] o.s.s.web.util.matcher.orrequestmatcher : trying match using ant [pattern='/configprops.'] 2016-04-29 10:00:05.797 debug 6020 --- [nio-8080-exec-1] o.s.s.w.u.matcher.antpathrequestmatcher : checking match of request : '/resource/upload_id_proof/40/11'; against '/configprops.' 2016-04-29 10:00:05.797 debug 6020 --- [nio-8080-exec-1] o.s.s.web.util.matcher.orrequestmatcher : trying match using ant [pattern='/configprops/'] 2016-04-29 10:00:05.797 debug 6020 --- [nio-8080-exec-1] o.s.s.w.u.matcher.antpathrequestmatcher : checking match of request : '/resource/upload_id_proof/40/11'; against '/configprops/' 2016-04-29 10:00:05.797 debug 6020 --- [nio-8080-exec-1] o.s.s.web.util.matcher.orrequestmatcher : no matches found 2016-04-29 10:00:05.797 debug 6020 --- [nio-8080-exec-1] o.s.security.web.filterchainproxy : /resource/upload_id_proof/40/11 @ position 1 of 13 in additional filter chain; firing filter: 'webasyncmanagerintegrationfilter' 2016-04-29 10:00:05.797 debug 6020 --- [nio-8080-exec-1] o.s.security.web.filterchainproxy : /resource/upload_id_proof/40/11 @ position 2 of 13 in additional filter chain; firing filter: 'securitycontextpersistencefilter' 2016-04-29 10:00:05.800 debug 6020 --- [nio-8080-exec-1] w.c.httpsessionsecuritycontextrepository : obtained valid securitycontext spring_security_context: 'org.springframework.security.core.context.securitycontextimpl@493c907: authentication: org.springframework.security.authentication.usernamepasswordauthenticationtoken@493c907: principal: org.springframework.security.core.userdetails.user@620: username: 11; password: [protected]; enabled: true; accountnonexpired: true; credentialsnonexpired: true; accountnonlocked: true; granted authorities: owner; credentials: [protected]; authenticated: true; details: org.springframework.security.web.authentication.webauthenticationdetails@fffd3270: remoteipaddress: 0:0:0:0:0:0:0:1; sessionid: b6cd10df-a20e-49ae-9212-d32e7520db8f; granted authorities: owner' 2016-04-29 10:00:05.800 debug 6020 --- [nio-8080-exec-1] o.s.security.web.filterchainproxy : /resource/upload_id_proof/40/11 @ position 3 of 13 in additional filter chain; firing filter: 'headerwriterfilter' 2016-04-29 10:00:05.800 debug 6020 --- [nio-8080-exec-1] o.s.s.w.header.writers.hstsheaderwriter : not injecting hsts header since did not match requestmatcher org.springframework.security.web.header.writers.hstsheaderwriter$securerequestmatcher@3439c41 2016-04-29 10:00:05.800 debug 6020 --- [nio-8080-exec-1] o.s.security.web.filterchainproxy : /resource/upload_id_proof/40/11 @ position 4 of 13 in additional filter chain; firing filter: 'csrffilter' 2016-04-29 10:00:05.800 debug 6020 --- [nio-8080-exec-1] o.s.security.web.csrf.csrffilter : invalid csrf token found http://localhost:8080/resource/upload_id_proof/40/11 2016-04-29 10:00:05.802 debug 6020 --- [nio-8080-exec-1] s.s.w.c.securitycontextpersistencefilter : securitycontextholder cleared, request processing completed please me proceed request further controller successfully.
Comments
Post a Comment