We Keep Coding

Spring boot works in Eclipse, not in docker

I've been working on a little spring boot app using docker-compose. I've got a container with the web app and one with the database. For development/debugging I've been launching just the database container using docker-compose and running the spring boot app in debug mode in Eclipse. So far, so good.
Then I try to run the whole thing using docker-compose. This is my yml file and log output below (some names have been changed to protect the innocent)...for testing the docker part I've mapped the jar file rather than rebuild the docker image every time.
version: '3'
services:
myapp-service:
image: myapp-service
env_file:
- common.env
ports:
- 8080:8080
volumes:
- "./target/myapp-service.jar:/myapp-service.jar"
depends_on:
- database
database:
image: mongo
env_file:
- common.env
volumes:
- "./init-mongo.js:/docker-entrypoint-initdb.d/init-mongo.js:ro"
ports:
- "27017-27019:27017-27019"
I have a custom login form, and running in Eclipse it works just fine. This is what I get when I run the whole thing in docker and navigate to the web page:
myapp-service_1 | 2020-05-04 00:20:27.083 DEBUG 1 --- [nio-8080-exec-8] o.s.security.web.FilterChainProxy : /login reached end of additional filter chain; proceeding with original chain
myapp-service_1 | 2020-05-04 00:20:27.083 DEBUG 1 --- [nio-8080-exec-8] o.s.web.servlet.DispatcherServlet : GET "/login", parameters={}
myapp-service_1 | 2020-05-04 00:20:27.084 DEBUG 1 --- [nio-8080-exec-8] s.w.s.m.m.a.RequestMappingHandlerMapping : Mapped to com.sammckee.data.controller.LoginController#login()
myapp-service_1 | 2020-05-04 00:20:27.085 DEBUG 1 --- [nio-8080-exec-8] o.s.w.s.v.ContentNegotiatingViewResolver : Selected 'text/html' given [text/html, application/xhtml+xml, image/webp, image/apng, application/xml;q=0.9, application/signed-exchange;v=b3;q=0.9, */*;q=0.8]
myapp-service_1 | 2020-05-04 00:20:27.085 DEBUG 1 --- [nio-8080-exec-8] o.s.web.servlet.view.JstlView : View name 'login', model {}
myapp-service_1 | 2020-05-04 00:20:27.086 DEBUG 1 --- [nio-8080-exec-8] o.s.web.servlet.view.JstlView : Forwarding to [/WEB-INF/views/login.jsp]
myapp-service_1 | 2020-05-04 00:20:27.092 DEBUG 1 --- [nio-8080-exec-8] o.s.s.w.header.writers.HstsHeaderWriter : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher#49e79d09
myapp-service_1 | 2020-05-04 00:20:27.092 DEBUG 1 --- [nio-8080-exec-8] w.c.HttpSessionSecurityContextRepository : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.web.servlet.DispatcherServlet : Completed 404 NOT_FOUND
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.s.w.a.ExceptionTranslationFilter : Chain processed normally
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.security.web.FilterChainProxy : /error at position 1 of 11 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.security.web.FilterChainProxy : /error at position 2 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] w.c.HttpSessionSecurityContextRepository : HttpSession returned null object for SPRING_SECURITY_CONTEXT
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: org.apache.catalina.session.StandardSessionFacade#6c18ca17. A new one will be created.
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.security.web.FilterChainProxy : /error at position 3 of 11 in additional filter chain; firing Filter: 'HeaderWriterFilter'
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.security.web.FilterChainProxy : /error at position 4 of 11 in additional filter chain; firing Filter: 'LogoutFilter'
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/logout', GET]
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/error'; against '/logout'
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/logout', POST]
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'GET /error' doesn't match 'POST /logout'
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/logout', PUT]
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'GET /error' doesn't match 'PUT /logout'
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/logout', DELETE]
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'GET /error' doesn't match 'DELETE /logout'
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.s.web.util.matcher.OrRequestMatcher : No matches found
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.security.web.FilterChainProxy : /error at position 5 of 11 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'GET /error' doesn't match 'POST /login'
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.security.web.FilterChainProxy : /error at position 6 of 11 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.s.w.s.DefaultSavedRequest : pathInfo: both null (property equals)
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.s.w.s.DefaultSavedRequest : queryString: both null (property equals)
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.s.w.s.DefaultSavedRequest : requestURI: arg1=/; arg2=/error (property not equals)
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.s.w.s.HttpSessionRequestCache : saved request doesn't match
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.security.web.FilterChainProxy : /error at position 7 of 11 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
myapp-service_1 | 2020-05-04 00:20:27.093 DEBUG 1 --- [nio-8080-exec-8] o.s.security.web.FilterChainProxy : /error at position 8 of 11 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
myapp-service_1 | 2020-05-04 00:20:27.094 DEBUG 1 --- [nio-8080-exec-8] o.s.s.w.a.AnonymousAuthenticationFilter : Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken#48fd2a32: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#0: RemoteIpAddress: 172.30.0.1; SessionId: 7F4F9718EE23E9AA0244329F374437D3; Granted Authorities: ROLE_ANONYMOUS'
myapp-service_1 | 2020-05-04 00:20:27.094 DEBUG 1 --- [nio-8080-exec-8] o.s.security.web.FilterChainProxy : /error at position 9 of 11 in additional filter chain; firing Filter: 'SessionManagementFilter'
myapp-service_1 | 2020-05-04 00:20:27.094 DEBUG 1 --- [nio-8080-exec-8] o.s.security.web.FilterChainProxy : /error at position 10 of 11 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
myapp-service_1 | 2020-05-04 00:20:27.094 DEBUG 1 --- [nio-8080-exec-8] o.s.security.web.FilterChainProxy : /error at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
myapp-service_1 | 2020-05-04 00:20:27.094 DEBUG 1 --- [nio-8080-exec-8] o.s.security.web.FilterChainProxy : /error reached end of additional filter chain; proceeding with original chain
myapp-service_1 | 2020-05-04 00:20:27.094 DEBUG 1 --- [nio-8080-exec-8] o.s.web.servlet.DispatcherServlet : "ERROR" dispatch for GET "/error", parameters={}
myapp-service_1 | 2020-05-04 00:20:27.094 DEBUG 1 --- [nio-8080-exec-8] s.w.s.m.m.a.RequestMappingHandlerMapping : Mapped to org.springframework.boot.autoconfigure.web.servlet.error.BasicErrorController#errorHtml(HttpServletRequest, HttpServletResponse)
myapp-service_1 | 2020-05-04 00:20:27.097 DEBUG 1 --- [nio-8080-exec-8] o.s.w.s.v.ContentNegotiatingViewResolver : Selected 'text/html' given [text/html, text/html;q=0.8]
myapp-service_1 | 2020-05-04 00:20:27.097 DEBUG 1 --- [nio-8080-exec-8] o.s.web.servlet.DispatcherServlet : Exiting from "ERROR" dispatch, status 404
myapp-service_1 | 2020-05-04 00:20:27.097 DEBUG 1 --- [nio-8080-exec-8] o.s.s.w.a.ExceptionTranslationFilter : Chain processed normally
myapp-service_1 | 2020-05-04 00:20:27.097 DEBUG 1 --- [nio-8080-exec-8] w.c.HttpSessionSecurityContextRepository : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
myapp-service_1 | 2020-05-04 00:20:27.097 DEBUG 1 --- [nio-8080-exec-8] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
Any thoughts on what I might be missing? Again, it works fine in Eclipse. Sorry for the long log text--I wanted to make sure I was giving all the info necessary.
Edit/addendum:
When I navigate to the web app I see this:
Whitelabel Error Page
This application has no explicit mapping for /error, so you are seeing this as a fallback.
Mon May 04 00:20:27 GMT 2020
There was an unexpected error (type=Not Found, status=404).
/WEB-INF/views/login.jsp
My DAOs derive from a class that connects to the database like this:
String client_url = "mongodb://" + dbuser + ":" + dbpassword + "#" + hostName + ":" + 27017 + "/"
+ databaseName;
...where the host name, database, user and password are passed in by environment variables.
For the hostname I'm passing in "database" because that's the container name--that's how it should work in the container, right? When I run it in Eclipse I pass in "localhost" for the host name because the database container exposes the same port number to the local environment, and it works fine. I sort of expect to see database error messages if it's a problem with my mongo connection, but maybe not.
Edit/Addendum 2:
It definitely looks like there's something Springy I'm doing wrong. I made a little shell script to set the environment variables and run the jar file standalone in bash, outside the container, and it works as expected. Inside the docker container, I get errors. This is the part of the log that catches my eye:
Returning cached instance of singleton bean 'loginController'
s.w.s.m.m.a.RequestMappingHandlerMapping : Mapped to com.myapp.bank.controller.LoginController#login()
.w.s.m.m.a.ServletInvocableHandlerMethod : Arguments: []
o.s.w.s.v.InternalResourceViewResolver : View with key [login] served from cache
o.s.w.s.v.ContentNegotiatingViewResolver : Selected 'text/html' given [text/html, application/xhtml+xml, image/webp, image/apng, application/xml;q=0.9, application/signed-exchange;v=b3;q=0.9, */*;q=0.8]
o.s.web.servlet.DispatcherServlet : Rendering view [org.springframework.web.servlet.view.JstlView: name 'login'; URL [/WEB-INF/views/login.jsp]]
o.s.web.servlet.view.JstlView : View name 'login', model {}
o.s.b.f.s.DefaultListableBeanFactory : Returning cached instance of singleton bean 'requestDataValueProcessor'
o.s.web.servlet.view.JstlView : Forwarding to [/WEB-INF/views/login.jsp]
o.s.s.w.header.writers.HstsHeaderWriter : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher#70ad1909
w.c.HttpSessionSecurityContextRepository : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
o.s.web.servlet.DispatcherServlet : Completed 404 NOT_FOUND, headers={masked}
o.s.s.w.a.ExceptionTranslationFilter : Chain processed normally
Edit/Addendum 3:
Still stumped. What I have confirmed is that I can copy the jar file to other places, and it runs fine there, serves up JSPs as expected and does everything I want it to do. So it seems to me the jar file itself must be okay. I'm mystified by what might be different when it's inside docker.

Issue with POST endpoint

I have created post endpoint with use of Spring Boot related to below code:
#PostMapping("/users/")
ResponseEntity<String> registerUser(#RequestBody JSONObject user) {
System.out.println("registerUser method triggered");
return userRegistrationResponseGenrator.generateResponse((userRegistrator.registerUser(user)));
}
When I however test the endpoint with code related to below
registrationPath = String.format("http://localhost:%s/users/", port);
#Test
public void registerUserTest() {
restTemplate.postForObject(registrationPath, validUserJSONObject, RequestEntity.class);
}
I face exception
org.springframework.web.client.HttpClientErrorException$Forbidden: 403 null
How can I resolve this issue?
Edit:
I have followed idea posted in one of comments and below are logs related to case
2018-11-26 19:43:35.110 INFO 5208 --- [o-auto-1-exec-1] o.a.c.c.C.[Tomcat].[localhost].[/] : Initializing Spring DispatcherServlet 'dispatcherServlet'
2018-11-26 19:43:35.110 INFO 5208 --- [o-auto-1-exec-1] o.s.web.servlet.DispatcherServlet : Initializing Servlet 'dispatcherServlet'
2018-11-26 19:43:35.152 INFO 5208 --- [o-auto-1-exec-1] o.s.web.servlet.DispatcherServlet : Completed initialization in 42 ms
2018-11-26 19:43:35.171 DEBUG 5208 --- [o-auto-1-exec-1] o.s.security.web.FilterChainProxy : /users at position 1 of 11 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
2018-11-26 19:43:35.173 DEBUG 5208 --- [o-auto-1-exec-1] o.s.security.web.FilterChainProxy : /users at position 2 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
2018-11-26 19:43:35.174 DEBUG 5208 --- [o-auto-1-exec-1] w.c.HttpSessionSecurityContextRepository : No HttpSession currently exists
2018-11-26 19:43:35.174 DEBUG 5208 --- [o-auto-1-exec-1] w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: null. A new one will be created.
2018-11-26 19:43:35.177 DEBUG 5208 --- [o-auto-1-exec-1] o.s.security.web.FilterChainProxy : /users at position 3 of 11 in additional filter chain; firing Filter: 'HeaderWriterFilter'
2018-11-26 19:43:35.178 DEBUG 5208 --- [o-auto-1-exec-1] o.s.security.web.FilterChainProxy : /users at position 4 of 11 in additional filter chain; firing Filter: 'CsrfFilter'
2018-11-26 19:43:35.387 WARN 5208 --- [o-auto-1-exec-1] o.a.c.util.SessionIdGeneratorBase : Creation of SecureRandom instance for session ID generation using [SHA1PRNG] took [200] milliseconds.
2018-11-26 19:43:35.392 DEBUG 5208 --- [o-auto-1-exec-1] o.s.security.web.csrf.CsrfFilter : Invalid CSRF token found for http://localhost:25012/users
2018-11-26 19:43:35.392 DEBUG 5208 --- [o-auto-1-exec-1] o.s.s.w.header.writers.HstsHeaderWriter : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher#377d8162
2018-11-26 19:43:35.393 DEBUG 5208 --- [o-auto-1-exec-1] w.c.HttpSessionSecurityContextRepository : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
2018-11-26 19:43:35.395 DEBUG 5208 --- [o-auto-1-exec-1] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
2018-11-26 19:43:35.401 DEBUG 5208 --- [o-auto-1-exec-1] o.s.security.web.FilterChainProxy : /error at position 1 of 11 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
2018-11-26 19:43:35.401 DEBUG 5208 --- [o-auto-1-exec-1] o.s.security.web.FilterChainProxy : /error at position 2 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
2018-11-26 19:43:35.402 DEBUG 5208 --- [o-auto-1-exec-1] w.c.HttpSessionSecurityContextRepository : HttpSession returned null object for SPRING_SECURITY_CONTEXT
2018-11-26 19:43:35.402 DEBUG 5208 --- [o-auto-1-exec-1] w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: org.apache.catalina.session.StandardSessionFacade#161e14b7. A new one will be created.
2018-11-26 19:43:35.402 DEBUG 5208 --- [o-auto-1-exec-1] o.s.security.web.FilterChainProxy : /error at position 3 of 11 in additional filter chain; firing Filter: 'HeaderWriterFilter'
2018-11-26 19:43:35.402 DEBUG 5208 --- [o-auto-1-exec-1] o.s.security.web.FilterChainProxy : /error at position 4 of 11 in additional filter chain; firing Filter: 'CsrfFilter'
2018-11-26 19:43:35.402 DEBUG 5208 --- [o-auto-1-exec-1] o.s.security.web.FilterChainProxy : /error at position 5 of 11 in additional filter chain; firing Filter: 'LogoutFilter'
2018-11-26 19:43:35.403 DEBUG 5208 --- [o-auto-1-exec-1] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/error'; against '/logout'
2018-11-26 19:43:35.403 DEBUG 5208 --- [o-auto-1-exec-1] o.s.security.web.FilterChainProxy : /error at position 6 of 11 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
2018-11-26 19:43:35.403 DEBUG 5208 --- [o-auto-1-exec-1] o.s.s.w.s.HttpSessionRequestCache : saved request doesn't match
2018-11-26 19:43:35.403 DEBUG 5208 --- [o-auto-1-exec-1] o.s.security.web.FilterChainProxy : /error at position 7 of 11 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
2018-11-26 19:43:35.405 DEBUG 5208 --- [o-auto-1-exec-1] o.s.security.web.FilterChainProxy : /error at position 8 of 11 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
2018-11-26 19:43:35.408 DEBUG 5208 --- [o-auto-1-exec-1] o.s.s.w.a.AnonymousAuthenticationFilter : Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken#9de06e39: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#957e: RemoteIpAddress: 127.0.0.1; SessionId: CF6283DA974F144F52398E23C94462E1; Granted Authorities: ROLE_ANONYMOUS'
2018-11-26 19:43:35.408 DEBUG 5208 --- [o-auto-1-exec-1] o.s.security.web.FilterChainProxy : /error at position 9 of 11 in additional filter chain; firing Filter: 'SessionManagementFilter'
2018-11-26 19:43:35.408 DEBUG 5208 --- [o-auto-1-exec-1] o.s.security.web.FilterChainProxy : /error at position 10 of 11 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
2018-11-26 19:43:35.408 DEBUG 5208 --- [o-auto-1-exec-1] o.s.security.web.FilterChainProxy : /error at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
2018-11-26 19:43:35.409 DEBUG 5208 --- [o-auto-1-exec-1] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/error'; against '/'
2018-11-26 19:43:35.410 DEBUG 5208 --- [o-auto-1-exec-1] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/error'; against '/users'
2018-11-26 19:43:35.410 DEBUG 5208 --- [o-auto-1-exec-1] o.s.s.w.a.i.FilterSecurityInterceptor : Public object - authentication not attempted
2018-11-26 19:43:35.411 DEBUG 5208 --- [o-auto-1-exec-1] o.s.security.web.FilterChainProxy : /error reached end of additional filter chain; proceeding with original chain
2018-11-26 19:43:35.481 DEBUG 5208 --- [o-auto-1-exec-1] w.c.HttpSessionSecurityContextRepository : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
2018-11-26 19:43:35.490 DEBUG 5208 --- [o-auto-1-exec-1] o.s.s.w.a.ExceptionTranslationFilter : Chain processed normally
2018-11-26 19:43:35.490 DEBUG 5208 --- [o-auto-1-exec-1] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
2018-11-26 19:43:35.527 INFO 5208 --- [ Thread-2] o.s.s.concurrent.ThreadPoolTaskExecutor : Shutting down ExecutorService 'applicationTaskExecutor'
2018-11-26 19:43:35.541 INFO 5208 --- [ Thread-2] j.LocalContainerEntityManagerFactoryBean : Closing JPA EntityManagerFactory for persistence unit 'default'
2018-11-26 19:43:35.547 INFO 5208 --- [ Thread-2] com.zaxxer.hikari.HikariDataSource : HikariPool-1 - Shutdown initiated...
2018-11-26 19:43:35.583 INFO 5208 --- [ Thread-2] com.zaxxer.hikari.HikariDataSource : HikariPool-1 - Shutdown completed.

If you have Spring Security on your classpath, it shuts down all resources with default user by default. In order to access any resource no matter what HTTP verb you are using - you have to authenticate. The exception occurs because you are not providing the required credentials. You have several options for fixing this exception.
First and easiest, remove Spring Security from your project.
If you want to access your resources, while preserving the ability to secure certain resources, you need to omit default security established for these resources by creating a bean, which extends org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter. Then, override its protected void configure(HttpSecurity http) throws Exception method.
E.g.
http.authorizeRequests()
.antMatchers("/your_path_1/**").permitAll()
.antMatchers("/your_path_2/example").permitAll()
// Disallow everything else..
.anyRequest().authenticated();
If you don't want to do that - you can just use an auto-generated password for the user "user" in order to access secured endpoint for the lifetime of one session, then you have to re-login. It gets printed in the logs when you start up your application.
Note:
For further reference, check out Spring Boot Security Reference.

Angular 6 Spring Boot POST Issue

I am trying to set up an angular 6 application that talks to a local spring boot REST application.
I have finally been able to login, and use GET requests, which seem to use the correct cookies. There are 2 cookies, a JSESSION cookie, and a XSRF cookie. The issue is I am getting a 403 response from any POST request. I am pretty confident that it is more of an issue with my Spring set up.
Spring Security config:
#Configuration
public class CORSConfig implements WebMvcConfigurer {
#Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**")
.allowedOrigins("http://localhost:4200")
.allowCredentials(true)
.allowedHeaders("*")
.allowedMethods("GET", "POST", "*")
.exposedHeaders("Set-Cookie","Authorization");
}
And
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.cors()
.and()
.httpBasic()
.and()
.authorizeRequests()
.antMatchers("/", "/main", "/user", "/runtime.js","/polyfills.js",
"/main.js", "/styles.js", "/vendor.js").permitAll()
.anyRequest().authenticated()
.and()
.csrf()
.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
.and().sessionManagement().maximumSessions(1).and()
.sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
}
Please note the antMatchers besides "/user" aren't actually being used in this set up. Those files are being served locally using ng serve.
My angular set up:
#Injectable()
export class AuthenticationInterceptor implements HttpInterceptor{
intercept(req: HttpRequest<any>, next: HttpHandler):
Observable<HttpEvent<any>>
{
const xhr = req.clone({
headers: req.headers.set('X-Requested-With', 'XMLHttpRequest'),
withCredentials: true
});
return next.handle(xhr);
}
This call will work now:
getExercise(id:Number): Observable<Exercise>
{
return this.http.get<Exercise>(environment.baseUrl + '/api/exercise/' + id);
}
But this one, a POST, will not.
saveExercise(exercise: Exercise): Observable<Exercise>
{
return this.http.post<Exercise>(environment.baseUrl +
'/newExercise',exercise);
}
Spring Security logs for the GET:
DEBUG 18776 --- [nio-8080-exec-1] o.s.b.w.s.f.OrderedRequestContextFilter : Bound request context to thread: org.apache.catalina.connector.RequestFacade#29dbd699
DEBUG 18776 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy : /api/exercise/2 at position 1 of 14 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
DEBUG 18776 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy : /api/exercise/2 at position 2 of 14 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
DEBUG 18776 --- [nio-8080-exec-1] w.c.HttpSessionSecurityContextRepository : No HttpSession currently exists
DEBUG 18776 --- [nio-8080-exec-1] w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: null. A new one will be created.
DEBUG 18776 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy : /api/exercise/2 at position 3 of 14 in additional filter chain; firing Filter: 'HeaderWriterFilter'
DEBUG 18776 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy : /api/exercise/2 at position 4 of 14 in additional filter chain; firing Filter: 'CorsFilter'
DEBUG 18776 --- [nio-8080-exec-1] o.s.s.w.header.writers.HstsHeaderWriter : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher#2de4577a
DEBUG 18776 --- [nio-8080-exec-1] w.c.HttpSessionSecurityContextRepository : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
DEBUG 18776 --- [nio-8080-exec-1] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
DEBUG 18776 --- [nio-8080-exec-1] o.s.b.w.s.f.OrderedRequestContextFilter : Cleared thread-bound request context: org.apache.catalina.connector.RequestFacade#29dbd699
DEBUG 18776 --- [nio-8080-exec-4] o.s.b.w.s.f.OrderedRequestContextFilter : Bound request context to thread: org.apache.catalina.connector.RequestFacade#29dbd699
DEBUG 18776 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /api/exercise/2 at position 1 of 14 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
DEBUG 18776 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /api/exercise/2 at position 2 of 14 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
DEBUG 18776 --- [nio-8080-exec-4] w.c.HttpSessionSecurityContextRepository : Obtained a valid SecurityContext from SPRING_SECURITY_CONTEXT: 'org.springframework.security.core.context.SecurityContextImpl#84a2a85a: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken#84a2a85a: Principal: com.op.movement.model.ApplicationUserDetails#7b5de4fa; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Not granted any authorities'
DEBUG 18776 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /api/exercise/2 at position 3 of 14 in additional filter chain; firing Filter: 'HeaderWriterFilter'
DEBUG 18776 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /api/exercise/2 at position 4 of 14 in additional filter chain; firing Filter: 'CorsFilter'
DEBUG 18776 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /api/exercise/2 at position 5 of 14 in additional filter chain; firing Filter: 'CsrfFilter'
DEBUG 18776 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /api/exercise/2 at position 6 of 14 in additional filter chain; firing Filter: 'LogoutFilter'
DEBUG 18776 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'GET /api/exercise/2' doesn't match 'POST /logout
DEBUG 18776 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /api/exercise/2 at position 7 of 14 in additional filter chain; firing Filter: 'ConcurrentSessionFilter'
DEBUG 18776 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /api/exercise/2 at position 8 of 14 in additional filter chain; firing Filter: 'BasicAuthenticationFilter'
DEBUG 18776 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /api/exercise/2 at position 9 of 14 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
DEBUG 18776 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /api/exercise/2 at position 10 of 14 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
DEBUG 18776 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /api/exercise/2 at position 11 of 14 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
DEBUG 18776 --- [nio-8080-exec-4] o.s.s.w.a.AnonymousAuthenticationFilter : SecurityContextHolder not populated with anonymous token, as it already contained: 'org.springframework.security.authentication.UsernamePasswordAuthenticationToken#84a2a85a: Principal: com.op.movement.model.ApplicationUserDetails#7b5de4fa; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Not granted any authorities'
DEBUG 18776 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /api/exercise/2 at position 12 of 14 in additional filter chain; firing Filter: 'SessionManagementFilter'
DEBUG 18776 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /api/exercise/2 at position 13 of 14 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
DEBUG 18776 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /api/exercise/2 at position 14 of 14 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
DEBUG 18776 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/exercise/2'; against '/'
DEBUG 18776 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/exercise/2'; against '/main'
DEBUG 18776 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/exercise/2'; against '/user'
DEBUG 18776 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/exercise/2'; against '/runtime.js'
DEBUG 18776 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/exercise/2'; against '/polyfills.js'
DEBUG 18776 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/exercise/2'; against '/main.js'
DEBUG 18776 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/exercise/2'; against '/styles.js'
DEBUG 18776 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/api/exercise/2'; against '/vendor.js'
DEBUG 18776 --- [nio-8080-exec-4] o.s.s.w.a.i.FilterSecurityInterceptor : Secure object: FilterInvocation: URL: /api/exercise/2; Attributes: [authenticated]
DEBUG 18776 --- [nio-8080-exec-4] o.s.s.w.a.i.FilterSecurityInterceptor : Previously Authenticated: org.springframework.security.authentication.UsernamePasswordAuthenticationToken#84a2a85a: Principal: com.op.movement.model.ApplicationUserDetails#7b5de4fa; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Not granted any authorities
DEBUG 18776 --- [nio-8080-exec-4] o.s.s.access.vote.AffirmativeBased : Voter: org.springframework.security.web.access.expression.WebExpressionVoter#74ead523, returned: 1
DEBUG 18776 --- [nio-8080-exec-4] o.s.s.w.a.i.FilterSecurityInterceptor : Authorization successful
DEBUG 18776 --- [nio-8080-exec-4] o.s.s.w.a.i.FilterSecurityInterceptor : RunAsManager did not change Authentication object
DEBUG 18776 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /api/exercise/2 reached end of additional filter chain; proceeding with original chain
Getting exercise by ID: 2
DEBUG 18776 --- [nio-8080-exec-4] org.hibernate.SQL : select exercise0_.id as id1_0_0_, exercise0_.instructions as instruct2_0_0_, exercise0_.name as name3_0_0_ from operation_movement.exercises exercise0_ where exercise0_.id=?
DEBUG 18776 --- [nio-8080-exec-4] org.hibernate.SQL : select goaltypes0_.exercise_id as exercise1_1_0_, goaltypes0_.goal_types_id as goal_typ2_1_0_, goaltype1_.id as id1_2_1_, goaltype1_.name as name2_2_1_ from operation_movement.exercises_goal_types goaltypes0_ inner join operation_movement.goaltypes goaltype1_ on goaltypes0_.goal_types_id=goaltype1_.id where goaltypes0_.exercise_id=?
DEBUG 18776 --- [nio-8080-exec-4] o.s.s.w.header.writers.HstsHeaderWriter : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher#2de4577a
DEBUG 18776 --- [nio-8080-exec-4] o.s.s.w.a.ExceptionTranslationFilter : Chain processed normally
DEBUG 18776 --- [nio-8080-exec-4] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
DEBUG 18776 --- [nio-8080-exec-4] o.s.b.w.s.f.OrderedRequestContextFilter : Cleared thread-bound request context: org.apache.catalina.connector.RequestFacade#29dbd699
Spring logs for the POST which returns a 403 response:
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /newExercise at position 1 of 14 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /newExercise at position 2 of 14 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
DEBUG 18776 --- [nio-8080-exec-7] w.c.HttpSessionSecurityContextRepository : Obtained a valid SecurityContext from SPRING_SECURITY_CONTEXT: 'org.springframework.security.core.context.SecurityContextImpl#84a2a85a: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken#84a2a85a: Principal: com.op.movement.model.ApplicationUserDetails#7b5de4fa; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Not granted any authorities'
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /newExercise at position 3 of 14 in additional filter chain; firing Filter: 'HeaderWriterFilter'
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /newExercise at position 4 of 14 in additional filter chain; firing Filter: 'CorsFilter'
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /newExercise at position 5 of 14 in additional filter chain; firing Filter: 'CsrfFilter'
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.csrf.CsrfFilter : Invalid CSRF token found for http://localhost:8080/newExercise
DEBUG 18776 --- [nio-8080-exec-7] o.s.s.w.header.writers.HstsHeaderWriter : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher#2de4577a
DEBUG 18776 --- [nio-8080-exec-7] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
DEBUG 18776 --- [nio-8080-exec-7] o.s.b.w.s.f.OrderedRequestContextFilter : Cleared thread-bound request context: org.apache.catalina.connector.RequestFacade#29dbd699
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /error at position 1 of 14 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /error at position 2 of 14 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
DEBUG 18776 --- [nio-8080-exec-7] w.c.HttpSessionSecurityContextRepository : Obtained a valid SecurityContext from SPRING_SECURITY_CONTEXT: 'org.springframework.security.core.context.SecurityContextImpl#84a2a85a: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken#84a2a85a: Principal: com.op.movement.model.ApplicationUserDetails#7b5de4fa; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Not granted any authorities'
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /error at position 3 of 14 in additional filter chain; firing Filter: 'HeaderWriterFilter'
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /error at position 4 of 14 in additional filter chain; firing Filter: 'CorsFilter'
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /error at position 5 of 14 in additional filter chain; firing Filter: 'CsrfFilter'
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /error at position 6 of 14 in additional filter chain; firing Filter: 'LogoutFilter'
DEBUG 18776 --- [nio-8080-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/error'; against '/logout'
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /error at position 7 of 14 in additional filter chain; firing Filter: 'ConcurrentSessionFilter'
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /error at position 8 of 14 in additional filter chain; firing Filter: 'BasicAuthenticationFilter'
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /error at position 9 of 14 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /error at position 10 of 14 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /error at position 11 of 14 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
DEBUG 18776 --- [nio-8080-exec-7] o.s.s.w.a.AnonymousAuthenticationFilter : SecurityContextHolder not populated with anonymous token, as it already contained: 'org.springframework.security.authentication.UsernamePasswordAuthenticationToken#84a2a85a: Principal: com.op.movement.model.ApplicationUserDetails#7b5de4fa; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Not granted any authorities'
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /error at position 12 of 14 in additional filter chain; firing Filter: 'SessionManagementFilter'
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /error at position 13 of 14 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /error at position 14 of 14 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
DEBUG 18776 --- [nio-8080-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/error'; against '/'
DEBUG 18776 --- [nio-8080-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/error'; against '/main'
DEBUG 18776 --- [nio-8080-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/error'; against '/user'
DEBUG 18776 --- [nio-8080-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/error'; against '/runtime.js'
DEBUG 18776 --- [nio-8080-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/error'; against '/polyfills.js'
DEBUG 18776 --- [nio-8080-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/error'; against '/main.js'
DEBUG 18776 --- [nio-8080-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/error'; against '/styles.js'
DEBUG 18776 --- [nio-8080-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/error'; against '/vendor.js'
DEBUG 18776 --- [nio-8080-exec-7] o.s.s.w.a.i.FilterSecurityInterceptor : Secure object: FilterInvocation: URL: /error; Attributes: [authenticated]
DEBUG 18776 --- [nio-8080-exec-7] o.s.s.w.a.i.FilterSecurityInterceptor : Previously Authenticated: org.springframework.security.authentication.UsernamePasswordAuthenticationToken#84a2a85a: Principal: com.op.movement.model.ApplicationUserDetails#7b5de4fa; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Not granted any authorities
DEBUG 18776 --- [nio-8080-exec-7] o.s.s.access.vote.AffirmativeBased : Voter: org.springframework.security.web.access.expression.WebExpressionVoter#74ead523, returned: 1
DEBUG 18776 --- [nio-8080-exec-7] o.s.s.w.a.i.FilterSecurityInterceptor : Authorization successful
DEBUG 18776 --- [nio-8080-exec-7] o.s.s.w.a.i.FilterSecurityInterceptor : RunAsManager did not change Authentication object
DEBUG 18776 --- [nio-8080-exec-7] o.s.security.web.FilterChainProxy : /error reached end of additional filter chain; proceeding with original chain
DEBUG 18776 --- [nio-8080-exec-7] o.s.s.w.a.ExceptionTranslationFilter : Chain processed normally
DEBUG 18776 --- [nio-8080-exec-7] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed

For any one having the same issue, doing
csrf().disable()
will fix this, though I have no idea why. It seems as spring CSRF and CORS clash in some way when using cookies...
If I had to guess, the below is not working as expected
.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
which is strange because it makes direct reference to Angular:
A CsrfTokenRepository that persists the CSRF token in a cookie named "XSRF-TOKEN" and
reads from the header "X-XSRF-TOKEN" following the conventions of AngularJS. When
using with AngularJS be sure to use withHttpOnlyFalse().
The above seems to be true - I see that the CSRF token is set and sent by the browser, but Spring is not accepting it as valid. (see logs above)
Invalid CSRF token found for http://localhost:8080/newExercise
Request Cookies
JSESSIONID 31AD5A7891F8BB83072BFC040AABBB35
XSRF-TOKEN 579db734-412c-4ce8-82a2-20aa097e47f
For now, disabling CSRF will work for development, but there is a real world use case for serving my angular app from a separate server, which is the ONLY server that should be able to make requests to my spring server. Hopefully the additional information can help someone, and I will try to post a real answer here if I ever find it.

Try to replace your .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()) with csrfTokenRepository and CsrfFilter:
.csrfTokenRepository(csrfTokenRepository()).and()
.addFilterAfter(csrfHeaderFilter(), CsrfFilter.class);
See full answer
#Override
protected void configure(HttpSecurity http) throws Exception {
http.httpBasic().and().authorizeRequests()
.antMatchers("/send-pin").permitAll()
.antMatchers("/check-pin").permitAll()
.antMatchers("/index.html", "/", "/login", "/someotherrurl")
.permitAll().anyRequest().authenticated().and().csrf()
.csrfTokenRepository(csrfTokenRepository()).and()
.addFilterAfter(csrfHeaderFilter(), CsrfFilter.class);

Spring oauth endpoint keeps returning 401

I have an oauth2 authorization server in spring which is also using spring security. The oauth endpoint (http://localhost:8080/oauth/token) keeps returning 401 even when I try to completely disable authorization.
I tried all of these solutions but none of them worked for me:
https://stackoverflow.com/a/42019669/2468620
https://stackoverflow.com/a/25674724/2468620
https://stackoverflow.com/a/43931256/2468620
Here is my security config:
#Override
public void configure(HttpSecurity http) throws Exception {
http.csrf().disable();
http.authorizeRequests().anyRequest().permitAll();
http.httpBasic().disable();
}
Here are the logs from processing the request:
2017-07-31 16:25:25.875 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/css/**']
2017-07-31 16:25:25.875 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/oauth/token'; against '/css/**'
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/js/**']
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/oauth/token'; against '/js/**'
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/images/**']
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/oauth/token'; against '/images/**'
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/webjars/**']
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/oauth/token'; against '/webjars/**'
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/**/favicon.ico']
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/oauth/token'; against '/**/favicon.ico'
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/error']
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/oauth/token'; against '/error'
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : No matches found
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/oauth/token']
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/oauth/token'; against '/oauth/token'
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : matched
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /oauth/token at position 1 of 11 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /oauth/token at position 2 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /oauth/token at position 3 of 11 in additional filter chain; firing Filter: 'HeaderWriterFilter'
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /oauth/token at position 4 of 11 in additional filter chain; firing Filter: 'LogoutFilter'
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/logout', GET]
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'POST /oauth/token' doesn't match 'GET /logout
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/logout', POST]
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/oauth/token'; against '/logout'
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/logout', PUT]
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'POST /oauth/token' doesn't match 'PUT /logout
2017-07-31 16:25:25.876 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/logout', DELETE]
2017-07-31 16:25:25.877 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'POST /oauth/token' doesn't match 'DELETE /logout
2017-07-31 16:25:25.877 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : No matches found
2017-07-31 16:25:25.877 DEBUG 6892 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /oauth/token at position 5 of 11 in additional filter chain; firing Filter: 'BasicAuthenticationFilter'
2017-07-31 16:25:25.877 DEBUG 6892 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /oauth/token at position 6 of 11 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
2017-07-31 16:25:25.877 DEBUG 6892 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /oauth/token at position 7 of 11 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
2017-07-31 16:25:25.877 DEBUG 6892 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /oauth/token at position 8 of 11 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
2017-07-31 16:25:25.877 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.w.a.AnonymousAuthenticationFilter : Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken#9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS'
2017-07-31 16:25:25.877 DEBUG 6892 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /oauth/token at position 9 of 11 in additional filter chain; firing Filter: 'SessionManagementFilter'
2017-07-31 16:25:25.877 DEBUG 6892 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /oauth/token at position 10 of 11 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
2017-07-31 16:25:25.877 DEBUG 6892 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy : /oauth/token at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
2017-07-31 16:25:25.877 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/oauth/token'; against '/oauth/token'
2017-07-31 16:25:25.877 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.w.a.i.FilterSecurityInterceptor : Secure object: FilterInvocation: URL: /oauth/token; Attributes: [fullyAuthenticated]
2017-07-31 16:25:25.877 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.w.a.i.FilterSecurityInterceptor : Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken#9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS
2017-07-31 16:25:25.877 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.access.vote.AffirmativeBased : Voter: org.springframework.security.web.access.expression.WebExpressionVoter#3c264a1d, returned: -1
2017-07-31 16:25:25.879 DEBUG 6892 --- [nio-8080-exec-4] o.s.s.w.a.ExceptionTranslationFilter : Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84) ~[spring-security-core-4.1.3.RELEASE.jar:4.1.3.RELEASE]
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233) ~[spring-security-core-4.1.3.RELEASE.jar:4.1.3.RELEASE]
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:124) ~[spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91) ~[spring-security-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]
...

Spring Boot OAuth sample is not authenticating

I am trying to learn how to set up OAuth2 with Spring Boot and Spring Cloud by following the instructions in this link, which is part 5 of a larger tutorial. After reading the tutorial several times and going step by step through it, I decided to study it again by simply downloading the completed version from github at this link.
The authserver, resource, and ui apps launch, but when I try to login, the authorization app does not accept the credentials given in the tutorial. I would like to get the example working as intended on my devbox before decomposing it and testing the effects of small changes.
The specific line in the debug logs that states the error sent by Spring to the view is:
o.s.security.web.FilterChainProxy :
/login?error reached end of additional filter chain;
proceeding with original chain
What specific steps need to be taken in order to 1.) download and install the apps and 2.) login successfully using the authentication server?
Here is what I have done so far:
On my CentOS 7 devbox terminal, I typed:
cd /home/user/spring_boot_apps/
mkdir whole_security_tutorial && cd whole_security_tutorial
git clone https://github.com/spring-guides/tut-spring-security-and-angular-js
cd /home/user/spring_boot_apps/whole_security_tutorial/tut-spring-security-and-angular-js/oauth2/authserver
mvn spring-boot:run
cd /home/user/spring_boot_apps/whole_security_tutorial/tut-spring-security-and-angular-js/oauth2/resource
mvn spring-boot:run
cd /home/user/spring_boot_apps/whole_security_tutorial/tut-spring-security-and-angular-js/oauth2/ui
mvn spring-boot:run
Then, in FireFox, I typed http://localhost:8080. This caused a page to load that included the home and login links that are intended, so I clicked on the login link, which redirected to the authorization app, which displayed a login page.
I typed in acme as the username and acmesecret as the password, but the authentication failed with the message There was a problem logging in. Please try again.
What am I doing wrong?
Note: I did not launch the app at /home/user/spring_boot_apps/whole_security_tutorial/tut-spring-security-and-angular-js/oauth2 because doing so in a prior attempt failed to give access to the other child apps while also causing the other apps to fail to launch due to port 9000 already being in use errors.
The Spring Boot debug log for the login attempt is as follows:
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/css/**']
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/css/**'
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/js/**']
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/js/**'
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/images/**']
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/images/**'
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/**/favicon.ico']
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/**/favicon.ico'
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/error']
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/error'
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.web.util.matcher.OrRequestMatcher : No matches found
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/login']
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/login'
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.web.util.matcher.OrRequestMatcher : matched
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.security.web.FilterChainProxy : /login at position 1 of 12 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.security.web.FilterChainProxy : /login at position 2 of 12 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] w.c.HttpSessionSecurityContextRepository : HttpSession returned null object for SPRING_SECURITY_CONTEXT
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: org.apache.catalina.session.StandardSessionFacade#2f575638. A new one will be created.
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.security.web.FilterChainProxy : /login at position 3 of 12 in additional filter chain; firing Filter: 'HeaderWriterFilter'
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.w.header.writers.HstsHeaderWriter : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher#63eea474
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.security.web.FilterChainProxy : /login at position 4 of 12 in additional filter chain; firing Filter: 'CsrfFilter'
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.security.web.FilterChainProxy : /login at position 5 of 12 in additional filter chain; firing Filter: 'LogoutFilter'
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/logout'
2016-04-11 01:56:10.805 DEBUG 17850 --- [nio-9999-exec-7] o.s.security.web.FilterChainProxy : /login at position 6 of 12 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
2016-04-11 01:56:10.806 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/login'
2016-04-11 01:56:10.806 DEBUG 17850 --- [nio-9999-exec-7] w.a.UsernamePasswordAuthenticationFilter : Request is to process authentication
2016-04-11 01:56:10.806 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.authentication.ProviderManager : Authentication attempt using org.springframework.security.authentication.dao.DaoAuthenticationProvider
2016-04-11 01:56:10.806 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.a.dao.DaoAuthenticationProvider : User 'acme' not found
2016-04-11 01:56:10.806 DEBUG 17850 --- [nio-9999-exec-7] w.a.UsernamePasswordAuthenticationFilter : Authentication request failed: org.springframework.security.authentication.BadCredentialsException: Bad credentials
2016-04-11 01:56:10.806 DEBUG 17850 --- [nio-9999-exec-7] w.a.UsernamePasswordAuthenticationFilter : Updated SecurityContextHolder to contain null Authentication
2016-04-11 01:56:10.806 DEBUG 17850 --- [nio-9999-exec-7] w.a.UsernamePasswordAuthenticationFilter : Delegating to authentication failure handler org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler#15daee11
2016-04-11 01:56:10.806 DEBUG 17850 --- [nio-9999-exec-7] .a.SimpleUrlAuthenticationFailureHandler : Redirecting to /login?error
2016-04-11 01:56:10.806 DEBUG 17850 --- [nio-9999-exec-7] o.s.s.web.DefaultRedirectStrategy : Redirecting to '/uaa/login?error'
2016-04-11 01:56:10.806 DEBUG 17850 --- [nio-9999-exec-7] w.c.HttpSessionSecurityContextRepository : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
2016-04-11 01:56:10.806 DEBUG 17850 --- [nio-9999-exec-7] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/css/**']
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/css/**'
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/js/**']
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/js/**'
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/images/**']
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/images/**'
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/**/favicon.ico']
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/**/favicon.ico'
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/error']
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/error'
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.web.util.matcher.OrRequestMatcher : No matches found
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/login']
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/login'
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.web.util.matcher.OrRequestMatcher : matched
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.security.web.FilterChainProxy : /login?error at position 1 of 12 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.security.web.FilterChainProxy : /login?error at position 2 of 12 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] w.c.HttpSessionSecurityContextRepository : HttpSession returned null object for SPRING_SECURITY_CONTEXT
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: org.apache.catalina.session.StandardSessionFacade#2f575638. A new one will be created.
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.security.web.FilterChainProxy : /login?error at position 3 of 12 in additional filter chain; firing Filter: 'HeaderWriterFilter'
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.w.header.writers.HstsHeaderWriter : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher#63eea474
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.security.web.FilterChainProxy : /login?error at position 4 of 12 in additional filter chain; firing Filter: 'CsrfFilter'
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.security.web.FilterChainProxy : /login?error at position 5 of 12 in additional filter chain; firing Filter: 'LogoutFilter'
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'GET /login' doesn't match 'POST /logout
2016-04-11 01:56:10.824 DEBUG 17850 --- [nio-9999-exec-8] o.s.security.web.FilterChainProxy : /login?error at position 6 of 12 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
2016-04-11 01:56:10.828 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'GET /login' doesn't match 'POST /login
2016-04-11 01:56:10.828 DEBUG 17850 --- [nio-9999-exec-8] o.s.security.web.FilterChainProxy : /login?error at position 7 of 12 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
2016-04-11 01:56:10.828 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.w.s.DefaultSavedRequest : pathInfo: both null (property equals)
2016-04-11 01:56:10.828 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.w.s.DefaultSavedRequest : queryString: arg1=client_id=acme&redirect_uri=http://localhost:8080/login&response_type=code&state=q0YqtY; arg2=error (property not equals)
2016-04-11 01:56:10.828 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.w.s.HttpSessionRequestCache : saved request doesn't match
2016-04-11 01:56:10.828 DEBUG 17850 --- [nio-9999-exec-8] o.s.security.web.FilterChainProxy : /login?error at position 8 of 12 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
2016-04-11 01:56:10.828 DEBUG 17850 --- [nio-9999-exec-8] o.s.security.web.FilterChainProxy : /login?error at position 9 of 12 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
2016-04-11 01:56:10.865 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.w.a.AnonymousAuthenticationFilter : Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken#905571d8: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#0: RemoteIpAddress: 127.0.0.1; SessionId: 49C866D11F4CC5AF4ACDC58145A672BA; Granted Authorities: ROLE_ANONYMOUS'
2016-04-11 01:56:10.865 DEBUG 17850 --- [nio-9999-exec-8] o.s.security.web.FilterChainProxy : /login?error at position 10 of 12 in additional filter chain; firing Filter: 'SessionManagementFilter'
2016-04-11 01:56:10.865 DEBUG 17850 --- [nio-9999-exec-8] o.s.security.web.FilterChainProxy : /login?error at position 11 of 12 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
2016-04-11 01:56:10.865 DEBUG 17850 --- [nio-9999-exec-8] o.s.security.web.FilterChainProxy : /login?error at position 12 of 12 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
2016-04-11 01:56:10.865 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.w.a.i.FilterSecurityInterceptor : Secure object: FilterInvocation: URL: /login?error; Attributes: [permitAll]
2016-04-11 01:56:10.865 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.w.a.i.FilterSecurityInterceptor : Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken#905571d8: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#0: RemoteIpAddress: 127.0.0.1; SessionId: 49C866D11F4CC5AF4ACDC58145A672BA; Granted Authorities: ROLE_ANONYMOUS
2016-04-11 01:56:10.865 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.access.vote.AffirmativeBased : Voter: org.springframework.security.web.access.expression.WebExpressionVoter#5cb57e17, returned: 1
2016-04-11 01:56:10.865 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.w.a.i.FilterSecurityInterceptor : Authorization successful
2016-04-11 01:56:10.865 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.w.a.i.FilterSecurityInterceptor : RunAsManager did not change Authentication object
2016-04-11 01:56:10.865 DEBUG 17850 --- [nio-9999-exec-8] o.s.security.web.FilterChainProxy : /login?error reached end of additional filter chain; proceeding with original chain
2016-04-11 01:56:10.867 DEBUG 17850 --- [nio-9999-exec-8] w.c.HttpSessionSecurityContextRepository : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
2016-04-11 01:56:10.867 DEBUG 17850 --- [nio-9999-exec-8] o.s.s.w.a.ExceptionTranslationFilter : Chain processed normally
2016-04-11 01:56:10.867 DEBUG 17850 --- [nio-9999-exec-8] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
2016-04-11 01:56:10.958 DEBUG 17850 --- [nio-9999-exec-9] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/css/**']
2016-04-11 01:56:10.958 DEBUG 17850 --- [nio-9999-exec-9] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/css/wro.css'; against '/css/**'
2016-04-11 01:56:10.958 DEBUG 17850 --- [nio-9999-exec-9] o.s.s.web.util.matcher.OrRequestMatcher : matched
2016-04-11 01:56:10.958 DEBUG 17850 --- [nio-9999-exec-9] o.s.security.web.FilterChainProxy : /css/wro.css has an empty filter list
2016-04-11 01:56:10.959 DEBUG 17850 --- [nio-9999-exec-9] .s.o.p.e.FrameworkEndpointHandlerMapping : Looking up handler method for path /css/wro.css
2016-04-11 01:56:10.959 DEBUG 17850 --- [nio-9999-exec-9] .s.o.p.e.FrameworkEndpointHandlerMapping : Did not find handler method for [/css/wro.css]
2016-04-11 01:56:10.961 DEBUG 17850 --- [io-9999-exec-10] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/css/**']
2016-04-11 01:56:10.961 DEBUG 17850 --- [io-9999-exec-10] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/js/wro.js'; against '/css/**'
2016-04-11 01:56:10.961 DEBUG 17850 --- [io-9999-exec-10] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/js/**']
2016-04-11 01:56:10.961 DEBUG 17850 --- [io-9999-exec-10] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/js/wro.js'; against '/js/**'
2016-04-11 01:56:10.961 DEBUG 17850 --- [io-9999-exec-10] o.s.s.web.util.matcher.OrRequestMatcher : matched
2016-04-11 01:56:10.961 DEBUG 17850 --- [io-9999-exec-10] o.s.security.web.FilterChainProxy : /js/wro.js has an empty filter list
2016-04-11 01:56:10.962 DEBUG 17850 --- [io-9999-exec-10] .s.o.p.e.FrameworkEndpointHandlerMapping : Looking up handler method for path /js/wro.js
2016-04-11 01:56:10.962 DEBUG 17850 --- [io-9999-exec-10] .s.o.p.e.FrameworkEndpointHandlerMapping : Did not find handler method for [/js/wro.js]
Alternatively, giving the credentials user and password, as per application.properties, results in a redirect to localhost:9000/uaa with an xml error message which states that you must be fully authenticated to view this resource.