CSRF Token Cookie HttpOnly Attribute set to True despite the com.c4-soft.springaddons.oidc.client.csrf = cookie-accessible-from-js property

[rodrigosomoza]

Hello,
I would like to know what are the possible things that might enforce the HttpOnly flag being set?
Like many i followed the bff tutorials, the system (frontend app, gateway and apis) that work perfectly fine with our Auth Server (Azure) in our environment. No issue in local with localhost, in dev and test with dedicated domain names but in our customer dev environment, all the post requests where failing. After investigated i saw that the XSRF-TOKEN Cookie had the HttpOnly flag set to true. I tested on different browser chrome/firefox with the same observation.
I did set the property com.c4-soft.springaddons.oidc.client.csrf = cookie-accessible-from-js property but seems that it doesn't work.
Any help would be very welcomed!
Rodrigo

[ch4mpy]

com.c4-soft.springaddons.oidc.client.csrf=cookie-accessible-from-js should configure the CSRF cookie with http-only set to false.

What are the versions you use (Boot, Security, and addons)?

What is your full Boot config for web, security, and addons?

[rodrigosomoza]

Thank you for taking the time to answer!
The dependency versions:

• Spring Boot Starter Webflux 3.5.8
• spring-cloud-starter-gateway-server-webflux 4.3.2
• spring-addons-starter-oidc 8.1.23
• spring-cloud-azure-starter-active-directory 6.0.0

=============
Here are the current configurations for our environments:

## OIDC config
oidc.client-name = lbs-webtool-sso
oidc.tenant-id =
oidc.client-id =
oidc.client-secret = ${oidc.client.secret}
oidc.username-claim-json-path = $.preferred_username
oidc.authorities-json-path = $.roles
oidc.audience =
oidc.issuer-uri = https://login.microsoftonline.com/${oidc.tenant-id}/v2.0
client-security-matchers = /login/**, \
/oauth2/**, \
/logout, \
/e112_wt_backend/**, \
/geoserver/**
client-permit-all = /login/**, \
/oauth2/**, \
/e112_wt_backend/**, \
/geoserver/**, \
/**
post-logout-redirect-uri = /
resource-server-permit-all = /, \
/bff/**, \
/login-options, \
/favicon.ico, \
/**

spring.security.oauth2.client.registration.lbs-webtool-sso.client-id = ${oidc.client-id}
spring.security.oauth2.client.registration.lbs-webtool-sso.client-secret = ${oidc.client-secret}
spring.security.oauth2.client.registration.lbs-webtool-sso.client-name = ${oidc.client-name}
spring.security.oauth2.client.registration.lbs-webtool-sso.provider = lbs-webtool-sso
spring.security.oauth2.client.registration.lbs-webtool-sso.scope = openid, \
  offline_access, \
  profile, \
  email, \
  api://${oidc.client-id}/.default
spring.security.oauth2.client.registration.lbs-webtool-sso.authorization-grant-type = authorization_code
spring.security.oauth2.client.registration.lbs-webtool-sso.client-authentication-method = client_secret_basic
spring.security.oauth2.client.registration.lbs-webtool-sso.redirect-uri = ${gateway.url}/login/oauth2/code/{registrationId}

spring.security.oauth2.client.provider.lbs-webtool-sso.issuer-uri = ${oidc.issuer-uri}

## Azure AD config
spring.cloud.azure.active-directory.enabled = true
spring.cloud.azure.active-directory.profile.tenant-id = ${oidc.tenant-id}
spring.cloud.azure.active-directory.credential.client-id = ${oidc.client-id}
spring.cloud.azure.active-directory.credential.client-secret = ${oidc.client-secret}

## C4Soft config
com.c4-soft.springaddons.oidc.ops[0].iss = ${oidc.issuer-uri}
com.c4-soft.springaddons.oidc.ops[0].authorities[0].path = ${oidc.authorities-json-path}
com.c4-soft.springaddons.oidc.ops[0].aud = ${oidc.audience}
com.c4-soft.springaddons.oidc.ops[0].username-claim = preferred_username
com.c4-soft.springaddons.oidc.client.client-uri = ${gateway.url}
com.c4-soft.springaddons.oidc.client.security-matchers = ${client-security-matchers}
com.c4-soft.springaddons.oidc.client.permit-all = ${client-permit-all}
com.c4-soft.springaddons.oidc.client.csrf = cookie-accessible-from-js
com.c4-soft.springaddons.oidc.client.back-channel-logout.enabled=true
com.c4-soft.springaddons.oidc.client.back-channel-logout.internal-logout-uri=${gateway.url}/bff/logout
com.c4-soft.springaddons.oidc.client.oauth2-redirections.rp-initiated-logout = ACCEPTED
com.c4-soft.springaddons.oidc.client.post-logout-redirect-path = ${post-logout-redirect-uri}
com.c4-soft.springaddons.oidc.resourceserver.permit-all = ${resource-server-permit-all}

=============
Here are the properties set by the customer on their environment:

## Server settings
server.port = 8443
server.ssl.key-store-password = <encrypted>
server.ssl.key-alias = <cert_name>

server.ssl.key-password = <encrypted>

spring.web.resources.static-locations = classpath:/static/
spring.webflux.static-path-pattern = /**
spring.cloud.gateway.server.webflux.httpclient.ssl.use-insecure-trust-manager = true
spring.cloud.gateway.server.webflux.httpserver.wiretap = false

## WebTool backend config
backend.url =<backend_url>

## GeoServer config
geoserver.url = <geoserver_url>

management.endpoints.enabled-by-default = false
management.endpoints.web.exposure.include = health, loggers, prometheus, metrics, application, trigger
management.endpoint.loggers.enabled = true
management.endpoint.health.enabled = true
management.endpoint.metrics.enabled = true
management.endpoint.prometheus.enabled = true
management.endpoint.health.show-details = always
management.health.defaults.enabled = false


## OIDC Configuration
### <MANDATORY> Service info
scheme = https
host =<host>
gateway.url = ${scheme}://${host}
client-security-matchers = /login/**, \
/oauth2/**, \
/logout, \
/e112_wt_backend/**
client-permit-all = /login/**, \
/oauth2/**, \
/e112_wt_backend/**, \
/geoserver/**, \
/**
post-logout-redirect-uri = /
resource-server-permit-all = /, \
/bff/**, \
/login-options, \
/favicon.ico, \
/**

## OIDC config
oidc.client-name = sp-LBSWebTool-d
oidc.tenant-id = <tenant_id>
oidc.client-id = <client_id>
oidc.client.secret = <client_secret>
oidc.issuer-uri = https://login.microsoftonline.com/${oidc.tenant-id}/v2.0
spring.security.oauth2.client.registration.sp-LBSWebTool-d.client-id = ${oidc.client-id}
spring.security.oauth2.client.registration.sp-LBSWebTool-d.client-secret = ${oidc.client.secret}
spring.security.oauth2.client.registration.sp-LBSWebTool-d.client-name = ${oidc.client-name}
spring.security.oauth2.client.registration.sp-LBSWebTool-d.provider = sp-LBSWebTool-d
spring.security.oauth2.client.registration.sp-LBSWebTool-d.scope = openid, \
  offline_access, \
  profile, \
  email, \
  api://${oidc.client-id}/.default
spring.security.oauth2.client.registration.sp-LBSWebTool-d.authorization-grant-type = authorization_code
spring.security.oauth2.client.registration.sp-LBSWebTool-d.client-authentication-method = client_secret_basic
spring.security.oauth2.client.registration.sp-LBSWebTool-d.redirect-uri = ${gateway.url}/login/oauth2/code/{registrationId}
spring.security.oauth2.client.provider.sp-LBSWebTool-d.issuer-uri = ${oidc.issuer-uri}

## Azure AD config
spring.cloud.azure.active-directory.enabled = true
spring.cloud.azure.active-directory.profile.tenant-id = ${oidc.tenant-id}
spring.cloud.azure.active-directory.credential.client-id = ${oidc.client-id}
spring.cloud.azure.active-directory.credential.client-secret = ${oidc.client-secret}
## Proxy config
proxy.enabled = true
proxy.insecure-trust-all-certificates = false
spring.cloud.azure.proxy.type = HTTP
spring.cloud.azure.proxy.hostname = <proxy_host>
spring.cloud.azure.proxy.port = 8080
spring.cloud.azure.proxy.http.non-proxy-hosts = <list_of_hosts>

## C4Soft config
com.c4-soft.springaddons.oidc.ops[0].iss = ${oidc.issuer-uri}
com.c4-soft.springaddons.oidc.ops[0].authorities[0].path = ${oidc.authorities-json-path}
com.c4-soft.springaddons.oidc.ops[0].aud = ${oidc.audience}
com.c4-soft.springaddons.oidc.ops[0].username-claim = preferred_username
com.c4-soft.springaddons.oidc.client.client-uri = ${gateway.url}
com.c4-soft.springaddons.oidc.client.security-matchers = ${client-security-matchers}
com.c4-soft.springaddons.oidc.client.permit-all = ${client-permit-all}
com.c4-soft.springaddons.oidc.client.csrf = cookie-accessible-from-js
com.c4-soft.springaddons.oidc.client.oauth2-redirections.rp-initiated-logout = accepted
com.c4-soft.springaddons.oidc.client.post-logout-redirect-path = ${post-logout-redirect-uri}
com.c4-soft.springaddons.oidc.resourceserver.permit-all = ${resource-server-permit-all}

pre-authorization-status = NO_CONTENT
post-authorization-status = NO_CONTENT

I am probably missing something because everything works fine on our environments but on theirs, all the post requests are blocked with a 403 from the gateway, the main difference observed is this XSRF-TOKEN cookie that has the HttpOnly flag set to true. I don't know if its a config thing or more likely an internal proxy/load balancer that might overriding the cookie attributes.
On our side when we receive the set-cookie header like this:
Set-Cookie: XSRF-TOKEN=<value>; Path=/; Secure
On the customer side:
set-cookie: XSRF-TOKEN=<value>; Path=/; Secure; HttpOnly
Spring app usually write the set-cookie in Pascal case while on the customer its in lower case.

[rodrigosomoza]

After investigation the issue was the load balancer overriding the header. Sorry for the inconvenience I will close the discussion!
Thank you

[ch4mpy]

Thank you for keeping me informed.

Would you kindly tell me what this load-balancer is and the name of the setting?

PS
I don't know why my previous comment isn't there. My internet connection might have failed when I submitted it. I was saying that it wouldn't be the 1st time that a Microsoft middleware does something unexpected and that it would be worth investigating further. Hopefully, you did and solved the problem by yourself.

[rodrigosomoza]

Yes sure! It was the vmware AVI load balancer that had a security option called HTTP-only Cookies checked which enforces and overrides the Set-Cookie header returned by the server. Updated the ansible scripts, the problem is gone thank you ! I also had an issue with Microsoft azure that was expecting non-standard additional parameters during the token exchange process, adding the com.azure.spring:spring-cloud-azure-starter-active-directory dependency with the configuration above fixed the issue. There is also the fact that Azure can deliver two different types of token: version 1 and version 2. We had an issue where the customer OP team didn't enforce the microsoft token v2 option in the Azure app manifest which led to authentication failures, just to say we had our struggles with Microsoft and their unique ways of doing things lol !