We Keep Coding

How to read and set CSRF token in Java (Prevent XSRF Security Token Missing)

In our Company we use BitBucket with our company URL: git.our-company.com
Now I want to create a new repository - automated by a Java application.
When I try to call the post-method I receive : XSRF Security Token Missing
I understand the basic concepts of CSRF (also called XSRF).
But what I am struggeling with is how to read this CSRF Token?
Where is it located / is there one place e.g. in a HEADER or hidden field?
Also how do I pass the token? I saw code like this : post.addRequestHeader("X-CSRF-Token",csrf); which seems pretty easy.
As said the application is BitBucket.

How to auto generate a JWT using ReadyAPI 3.6.0

I have a Spring Boot application which uses JWT for authorization. I have a basic understanding of OAuth and JWT but this application uses more things I'm not currently familiar with. So, in order to generate a JWT to use in this application, we execute a command similar to this:
java -jar jwt-bearer-token-acquirer-1.0.18.jar
--legacyVerifierKeyEndpoint https://example.com/oauth/token_key
--tokenEndpoint https://example.com/oauth/token
--issuer ABC123
--subject ABC123
--scope /myapp/myscope
--privateKeySignerFile C:\mykeyfile.jks
--jksKeyAlias ABC123
--jksKeyStorePassword myPassword
--jksKeyPassword myOtherPassword
Once we get a JWT with this command, we can make the API call and returns the expected results.
So now, I was requested to see how to auto generate JWT's using ReadyAPI so our validators can run tests without manually generating tokens. After reading a lot on their documentation here https://support.smartbear.com/readyapi/docs/requests/auth/types/oauth2/generate-jwt.html?sbsearch=auto%20generate%20token I am still not able to understand what to do.
I was able to add the key store information but I'm not sure where or how to tell ReadyAPI to generate a complete JWT since I don't know where to put things like the verifier key endpoint or the token endpoint.
I would greatly appreciate any help.
Thank you all in advance.

You said:
...this application uses more things I'm not currently familiar with.
so you will probably not be able to use the default ReadyAPI mechanism to generate your JWT.
start a testcase, and open the Setup tab.
In the setup you can use something like "command".execute() to run your command. See this SO Q&A for additional info. If you can get your developers to show you how to call your jwt-bearer-token-acquirer-1.0.18.jar from Java/Groovy, that would simplify this.
In the script store the JWT token in something like def token = "command".execute(). And store the token in a testcase property: testCase.setPropertyValue('token', token)
Start adding REST calls to your testcase. For each REST call you make you will have to Add custom headers: Authorization with value bearer ${#TestCase#token}. If you are feeling up to it, this can be simplified with custom Events.

Setting up own security in Spring Boot

I have studied plenty tutorials and pages about Spring Boot Security. But none of them answered my questions. And here they are:
I´m building web app in Spring Boot. And I need to authenticate users via classic session (username, password). But as I know a lot of things are predefined in Spring Boot. And I want to change few things.
1) The only page which DO NOT NEED authentication is /. Here is also login form. Rest of pages MUST BE authenticated. So I do not want to use default URL /login. And what I have to write into form´s action?
2) I also need need unauthenticated routes for static resources. They are located: src/main/resource/static/css
3) Is there a way to edit logout? Like to add a code during logout action?
Can you show me how configure method of WebSecurityConfigurerAdapter should look like? I have already tried a lot of configurations, but they didnt work.
Thank you for your responses.

I recommend you to have a look at this tutorial for a specific login and logout page.
With antmatchers you can also define that your static content is not secured.See here
For adding logic between spring defined processes like logout you should have a look at the spring filter pipelines especially the Logoutfiler. This was already discussed here
It would also be an easy way to set the logout url to a rest endpoint, execute the action you want an then redirect to the auth service. In my opion the filter way is the better solution and cleaner.
I hope this helps to get on track. cheers

Abnormal Behaviour of Web Browser

I was working on a Spring-security LDAP application. I'm following the link - https://spring.io/guides/gs/authenticating-ldap/ . Problem I'm facing is that I have made a very simple controller and a method to handle a request, returning a string. But browser is opening a login page (which I can't find anywhere). I deleted cache, restarted Eclipse and system both but to my dismay it displays the same page irrespective of any url configured in controller or any port. I'm unable to elucidate this behavior of browser.

If you had followed the guide exactly as it is, then you may notice that the file WebSecurityConfig.java has the following line http.authorizeRequests()
.anyRequest().fullyAuthenticated()
.and().formLogin(); Which means that all your requests need to be authenticated. That means any end points that you define need to be authenticated too. They are secured by default.
You seem to have made a GET request to your endpoint, which is secured by Spring Security. If you want to create an unsecure endpoint then you have to make changes to the WebSecurityConfig file.
The login page that you mention is provided by Spring security library itself. It won't be available in your cloned project. At the end of the page they have also mentioned that the username is ben and password is benspassword. Spring security provides lot of default options which are useful. But, unless you read the documentation to understand what they are, you are in for quite a few surprises.

Java Spring MVC Auth0 SSO not getting tokens (no Spring Boot)

I'm trying to get SSO up and running. So when I sign in on a different application (on the same auth0 domain) and go to the login page of my application I want my application to automatically log me in.
I managed to get the first parts running and I received an authorization code from auth0. But when I try to retrieve the tokens they are all null.
my redirectuUri and clientSecret are correct and I assume the authorization code returned earlier is correct aswell.
It seems as if the request doesn't return any tokens. They are all null.
Where do I start to find out what's going wrong? Thanks!
public Tokens getTokens(final String authorizationCode, final String redirectUri) {
Validate.notNull(authorizationCode);
Validate.notNull(redirectUri);
System.out.println("Sending request with code to retrieve tokens.");
final Credentials creds = authenticationAPIClient
.token(authorizationCode, redirectUri)
.setClientSecret(clientSecret).execute();
return new Tokens(creds.getIdToken(), creds.getAccessToken(), creds.getType(), creds.getRefreshToken());
}

If using the Auth0 Spring MVC Library (not Spring Security MVC) - then best place to stick a breakpoint would at the top of the Callback Controller's handle method
You can then step through / step in - and inspect what is going on. This method calls getTokens and that delegates to Auth0ClientImpl which is the code block you reference in the question.
Check your ClientId, ClientSecret and Domain are all correct - and if your code is reaching this method - that the code / redirectURI being passed in are also correct. Would check the Auth0 logs from the Dashboard too, and determine if any successful authentication events are recorded.
Finally, please can you confirm which version of auth0-java (maven POM dependency / gradle dependency) you are using - and which version of the auth0-spring-mvc library you are referencing also.
For SSO Specific Examples - plain Spring falls between two stools as I wrote one for plain java and one for Spring Security MVC - but you should get a good idea of what is going on by studying these two samples:
Auth0 Servlet SSO Sample
Auth0 Spring Security SSO Sample
In particular, study the JSP pages since that is where the SSO checks and auto-login logic lives. Ensure too that you enable SSO on the Settings of each of your Clients defined in your Auth0 tenant.
Disclaimer: am the author of the above libraries - please leave me comments below if you still have problems and require any clarifications.