search

MarcGiffing / wicket-spring-boot

Spring Boot starter for Apache Wicket
152 stars 62 forks source link

[Spring-Security] 403 on AjaxButton Click #179

Closed c-grosz closed 2 years ago

c-grosz commented 3 years ago

Hello,

i have a very simple demo application with Wicket 9.0.0 and Spring Security. There is only the HomePage with a form that has an AjaxButton. After opening the page und logging in i get to the HomePage. Up to here everything is fine and good. When submitting the form nothing happens. No error feedback, nothing on the server console. Only the Browser Development Console (F12) shows the Ajax request is returned with status 403. Any ideas why a normal Ajax request is forbidden?

Thanks

martin-g commented 3 years ago

Hi,

Do you use Spring Security? Please paste the http response headers for both requests - normal and ajax.

On Fri, Jul 30, 2021, 09:55 c-grosz @.***> wrote:

Hello,

i have a very simple demo application with Wicket 9.0.0 and Spring Security. There is only the HomePage with a form that has an AjaxButton. After opening the page und logging in i get to the HomePage. Up to here everything is fine and good. When submitting the form nothing happens. No error feedback, nothing on the server console. Only the Browser Development Console (F12) shows the Ajax request is returned with status 403. Any ideas why a normal Ajax request is forbidden?

Thanks

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/MarcGiffing/wicket-spring-boot/issues/179, or unsubscribe https://github.com/notifications/unsubscribe-auth/AABYUQVBDH3YCMEBO2OLVD3T2JEEZANCNFSM5BH5LNUQ .

c-grosz commented 3 years ago

Hi Martin, yes i'm using Spring Security. Its in the class path so only a/the default user with a random password is usable. I wanted to set up Spring LDAP next. But first the error must be solven i guess. Anyways, the response headers: Page load:

HTTP/1.1 200 Date: Sat, 31 Jul 2021 11:15:14 GMT Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache Cache-Control: no-cache, no-store X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Frame-Options: DENY Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Keep-Alive: timeout=60 Connection: keep-alive X-DNS-Prefetch-Control: off

Ajax submit:

HTTP/1.1 403 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 X-Frame-Options: DENY Content-Type: application/json Transfer-Encoding: chunked Date: Sat, 31 Jul 2021 11:10:47 GMT Keep-Alive: timeout=60 Connection: keep-alive