Apply SecurityConfigurer in HttpSecurity is not consistence

[kakawait]

Update

I edit the title to change to more generic issue, please read my response to get more information about generic issue

Summary

When reading doc from LogoutConfigurer

The URL that triggers log out to occur (default is "/logout"). If CSRF protection
is enabled (default), then the request must also be a POST. This means that by
default POST "/logout" is required to trigger a log out. If CSRF protection is
disabled, then any HTTP method is allowed.

This partially true, because in reality it depends on the presence of CsrfConfigurer and not if CSRF truly enabled or not.

Actual Behavior

With such configuration that clearly disable CSRF, logout will still be only on POST

http.authorizeRequests().anyRequest().authenticated()
    .and()
    .apply(new SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity>() {
        @Override
        public void init(HttpSecurity http) throws Exception {
            http.csrf().disable();
        }
    });

By using apply() this SecurityConfigurerAdapter will be append to the list of SecurityConfigurer. The main problem is append to since LogoutConfigurer is already presents by default (in Spring boot project at least) it will be configurer before this SecurityConfigurerAdapter and CsrfConfigurer will still present when LogoutConfigurer will be executed.

I know that a stupid sample because I can use directly http.csrf().disable() without using SecurityConfigurerAdapter and apply() method. But keep in mind that in my use case I'm developing a starter that getting this (or those) SecurityConfigurerAdapter from injection, so I can't control what SecurityConfigurerAdapter could contains.

Expected Behavior

If possible since I think I will be a bit tricky to achieve that will be to change how LogoutConfigurer determines if CSRF will be enable.

Configuration

I don't think is relevant

Version

• Spring boot 1.5.x
• Spring security 4.2.x

Sample

I will try to upload asap if really needed

[kakawait]

In addition in think the main issue is about .apply() method and SecurityConfigurer that is not as reliable as changing HttpSecurity object directly. Another sample of inconsistency behavior can be found on following gitter discussion https://gitter.im/spring-projects/spring-security?at=595513da8dae425031686318

To summarize following code is working as expected with Spring boot sample app

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests().anyRequest().fullyAuthenticated().and().formLogin()
            .loginPage("/login").failureUrl("/login?error").permitAll().and()
            .logout().logoutSuccessUrl("/logout").permitAll();
}

Whereas this following not

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests().anyRequest().fullyAuthenticated().and().formLogin()
            .loginPage("/login").failureUrl("/login?error").permitAll().and()
            .apply(new SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity>() {
                @Override
                public void init(HttpSecurity builder) throws Exception {
                    http.logout().logoutSuccessUrl("/logout").permitAll();
                }
            });
}

See gitter discussion for more details and explanations https://gitter.im/spring-projects/spring-security?at=595513da8dae425031686318

The thing that @dsyer suggest me (I will adopt it for now) is to create my own Configurer with method void configure(HttpSecurity http); that I will apply directly on HttpSecurity object instead of using .apply() like he did for Spring Security OAuth https://github.com/spring-projects/spring-security-oauth/blob/master/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/ResourceServerConfiguration.java#L135

for (MyCustomConfigurer configurer : configurers) {
    configurer.configure(resources);
}

I think that that's too bad to do not use existing interface SecurityConfigurer and method .apply() and instead recreate your own logic.

---

Otherwise I suggested

I though to get a way to reconfigure SecurityConfigurer (even if those SecurityConfigurer was retrieve using .getOrApply() and get is using not apply) by calling init() (and configure()?) each time the SecurityConfigurer is modified (but not after Builder state becomes BUILT obviously)

[awattez]

Hi,
I have the same problem here with requestMatchers, in my WebSecurityConfigurerAdapter:

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // @formatter:off
        http.addFilterBefore(corsFilter, UsernamePasswordAuthenticationFilter.class).exceptionHandling()
            .authenticationEntryPoint(problemSupport).accessDeniedHandler(problemSupport)
            .and()
                .csrf().disable()
                .headers().frameOptions().disable()
            .and()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
                .authorizeRequests()
                    .antMatchers("/api/profile-info").permitAll()
                    .antMatchers("/api/authenticate").permitAll()
                    .antMatchers("/management/health").permitAll()
                    .antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
                    .antMatchers("/v2/api-docs/**").permitAll()
                    .antMatchers("/swagger-resources/configuration/ui").permitAll()
                    .antMatchers("/swagger-ui/index.html").hasAuthority(AuthoritiesConstants.ADMIN)
            .and()
                .apply(new SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity>() {
                    @Override
                    public void configure(HttpSecurity http) throws Exception {
                        AntPathRequestMatcher antPathRequestMatcher = new AntPathRequestMatcher("/toto/*", "GET");
                        http.authorizeRequests().requestMatchers(antPathRequestMatcher).hasAnyRole("SID");
                    }
                });
    }

When i enable debug log in AntPathRequestMatcher, i don't have any "Checking match of request" with /toto/

It seems that we can only add some filter or define order inside the SecurityConfigurerAdapter.
apply and authorizeRequests().requestMatchers are not working.

Is it possible to have more documentation about SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity>
Especially what we can configure inside the public void configure(HttpSecurity http).

Expected Behavior
The AntPathRequestMatcher check "match of request" with /toto/ which is configure inside a SecurityConfigurerAdapter

Version

• Spring boot 1.5.x
• Spring security 4.2.x