Finding: CSRF required to be included in both cookie and header

 


Found out need to have CSRF token in cookies + header

C:\Users\billson.bs.chew>curl "http://localhost:9099/sfa/getrefcountry" -X "POST" -H "Cookie: JSESSIONID=ECF471E0BB423ADF808EFC649965D63D; XSRF-TOKEN=8078038f-017c-4adf-9034-71d0a5624020; OAuth_Token_Request_State=45f11140-bc27-4d82-9e06-ac7716150d9b"

{"timestamp":"2023-01-12T05:14:04.958+00:00","status":403,"error":"Forbidden","message":"Forbidden","path":"/sfa/getrefcountry"}

C:\Users\billson.bs.chew>

C:\Users\billson.bs.chew>

C:\Users\billson.bs.chew>

C:\Users\billson.bs.chew>

C:\Users\billson.bs.chew>curl "http://localhost:9099/sfa/getrefcountry" -X "POST" -H "Cookie: JSESSIONID=ECF471E0BB423ADF808EFC649965D63D; OAuth_Token_Request_State=45f11140-bc27-4d82-9e06-ac7716150d9b" -H "X-XSRF-TOKEN: 8078038f-017c-4adf-9034-71d0a5624020"

{"timestamp":"2023-01-12T05:14:17.134+00:00","status":403,"error":"Forbidden","message":"Forbidden","path":"/sfa/getrefcountry"}

C:\Users\billson.bs.chew>

C:\Users\billson.bs.chew>

C:\Users\billson.bs.chew>

C:\Users\billson.bs.chew>curl "http://localhost:9099/sfa/getrefcountry" -X "POST" -H "Cookie: JSESSIONID=ECF471E0BB423ADF808EFC649965D63D; XSRF-TOKEN=8078038f-017c-4adf-9034-71d0a5624020; OAuth_Token_Request_State=45f11140-bc27-4d82-9e06-ac7716150d9b" -H "X-XSRF-TOKEN: 8078038f-017c-4adf-9034-71d0a5624020"

[{"id":746,"countryName":"......

But will failed after added -H "X-Requested-With: XMLHttpRequest"

curl "http://localhost:9099/sfa/getrefcountry" -X "POST" -H "Cookie: JSESSIONID=72E583341F34F836CE9D1E791BAA8289; XSRF-TOKEN=8078038f-017c-4adf-9034-71d0a5624020; OAuth_Token_Request_State=45f11140-bc27-4d82-9e06-ac7716150d9b" -H "X-XSRF-TOKEN: 8078038f-017c-4adf-9034-71d0a5624020" -H "X-Requested-With: XMLHttpRequest"

maybe required to add the origin header as well.

curl "http://localhost:9099/sfa/getrefcountry" -X "POST" -H "Cookie: JSESSIONID=4174FC81554467718FC1F68CA393A357; XSRF-TOKEN=9c5dd88b-837b-400a-b083-912cc83aaa9f; OAuth_Token_Request_State=45f11140-bc27-4d82-9e06-ac7716150d9b" -H "X-XSRF-TOKEN: 9c5dd88b-837b-400a-b083-912cc83aaa9f" -H "Origin: http://localhost:9099" -H "X-Requested-With: XMLHttpRequest"

Solved - ClassNotFoundException: org.springframework.boot.configurationprocessor.json.JSONObject

 
Exception:

java.lang.ClassNotFoundException: org.springframework.boot.configurationprocessor.json.JSONObject

Artifact below won't be included into maven install

<dependency>

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-configuration-processor</artifactId>

<optional>true</optional>

</dependency>

replaced

org.springframework.boot.configurationprocessor.json.JSONObject

by

org.json.JSONObject

 

OAuthRequestAuthenticator : failed to turn code into token

 


I was having:

2022-12-07 09:21:25.077 ERROR 25057 --- [nio-8001-exec-4] o.k.adapters.OAuthRequestAuthenticator   : failed to turn code into token

java.net.ConnectException: Connection timed out (Connection timed out)

        at java.net.PlainSocketImpl.socketConnect(Native Method) ~[na:1.8.0_352]

        at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350) ~[na:1.8.0_352]

        at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206) ~[na:1.8.0_352]

        at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188) ~[na:1.8.0_352]

        at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) ~[na:1.8.0_352]

        at java.net.Socket.connect(Socket.java:607) ~[na:1.8.0_352]

        at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:542) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.keycloak.adapters.SniSSLSocketFactory.connectSocket(SniSSLSocketFactory.java:109) ~[keycloak-adapter-core-4.5.0.Final.jar!/:4.5.0.Final]

        at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:414) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:180) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:144) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:134) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:610) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:445) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:835) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.keycloak.adapters.ServerRequest.invokeAccessCodeToToken(ServerRequest.java:111) ~[keycloak-adapter-core-4.5.0.Final.jar!/:4.5.0.Final]

        at org.keycloak.adapters.OAuthRequestAuthenticator.resolveCode(OAuthRequestAuthenticator.java:335) ~[keycloak-adapter-core-4.5.0.Final.jar!/:4.5.0.Final]

        at org.keycloak.adapters.OAuthRequestAuthenticator.authenticate(OAuthRequestAuthenticator.java:280) ~[keycloak-adapter-core-4.5.0.Final.jar!/:4.5.0.Final]

        at org.keycloak.adapters.RequestAuthenticator.authenticate(RequestAuthenticator.java:139) ~[keycloak-adapter-core-4.5.0.Final.jar!/:4.5.0.Final]

        at org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.authenticateInternal(AbstractKeycloakAuthenticatorValve.java:203) ~[keycloak-tomcat-core-adapter-4.5.0.Final.jar!/:4.5.0.Final]

        at org.keycloak.adapters.tomcat.KeycloakAuthenticatorValve.authenticate(KeycloakAuthenticatorValve.java:50) [keycloak-tomcat8-adapter-4.5.0.Final.jar!/:4.5.0.Final]

        at org.keycloak.adapters.tomcat.KeycloakAuthenticatorValve.doAuthenticate(KeycloakAuthenticatorValve.java:57) [keycloak-tomcat8-adapter-4.5.0.Final.jar!/:4.5.0.Final]

        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:556) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.invoke(AbstractKeycloakAuthenticatorValve.java:181) ~[keycloak-tomcat-core-adapter-4.5.0.Final.jar!/:4.5.0.Final]

        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:677) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:349) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:783) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:798) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1434) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_352]

        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_352]

        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at java.lang.Thread.run(Thread.java:750) [na:1.8.0_352]

Found out that server couldn't curl to keyclock which installed on the same machine by using public domain:

curl https://your.public.keycloak.com

curl: (7) Failed connect to your.public.keycloak.com:443; Connection timed out

 

how to get mylyn task for eclipse

 



how to get mylyn task for eclipse



https://www.eclipse.org/mylyn/downloads/

Add URL into eclipse: http://download.eclipse.org/mylyn/releases/latest






Tried, outdate, not working.

https://people.cs.vt.edu/~gback/eclipse/configuration/org.eclipse.osgi/bundles/171/1/.cp/Mylyn/FAQ/Installation.html

SVN with eclipse 2022-09

 

Attempt# 1 - failed:

Name: SVN

Location: http://download.Eclipse.org/technology/subversive/4.0/update-site/

reference URL: https://www.softwaretestinghelp.com/eclipse/configuring-svn-and-eclipse/

Attempt# 2

Last comment in: https://bugs.eclipse.org/bugs/show_bug.cgi?id=576745

https://www.eclipse.org/subversive/installation-instructions.php

Looks alright.

resolved by: remove "TLSv1, TLSv1.1"

Reference URL: https://stackoverflow.com/a/71050085

You can set it in JRE inside SoapUI (if you are using it): Remove "TLSv1, TLSv1.1" from "jdk.tls.disabledAlgorithms" property in file ${soapui_home}/jre/conf/securityjava.security.

Path at: .\Eclipse\eclipse-jee-2022-12-R-win32-x86_64\plugins\org.eclipse.justj.openjdk.hotspot.jre.full.win32.x86_64_17.0.6.v20230204-1729\jre\conf\security\java.security

For later versions: 

SVN with eclipse 2022-12 R & 2023-06 R

https://billson.blogspot.com/2023/03/svn-with-eclipse-2022-12.html

 

Resolved - Unable to make field private final java.util.Comparator java.util.TreeMap.comparator accessible

 


Error:

Unable to make field private final java.util.Comparator java.util.TreeMap.comparator accessible: module java.base does not "opens java.util" to unnamed module @3d201878

By referring to:

https://stackoverflow.com/a/72616180

Added into <properties> section in pom.xml:

<maven-war-plugin.version>3.3.1</maven-war-plugin.version>

<maven-compiler-plugin.version>3.8.1</maven-compiler-plugin.version>

Added on 20230823_pm092210:

To resolve:

- Maven Configuration Problem - java.lang.ExceptionInInitializerError

- Unable to make field private final java.util.Comparator

Reduce hibernate file

 


powercfg /hibernate /type reduced

reduced my hibernate file: C:\hiberfil.sys

from: 6.35 GB

to: 3.17 GB

But will disable your machine to go into hibernate...

Steps to setup your new android phones and copy almost everything from old phone(android).

1. Factory Reset / Turn on the new phone. 
2. Select copy data from old phone.
3. Answer to your new phone couldn't setup via cable.
4. Continue copy data wirelessly.
5. Follow the guide in new phone, to Open Google App in old phone, and continue as per instruction.

AsciidocFX.exe infected with IDP.Generic Virus.

 


Downloaded from: https://asciidocfx.com/

Corrupted GitLab 15.2 was back to online.

 




GitLab 15.2 was corrupted due to whatever reasons...

finally service back to running by:

sudo gitlab-ctl reconfigure

MySQL backup time consumed

version: 8.0.30

MySQL dump

zipped

100MB / 90 seconds

700MB+ / 10 mins

Resolved: has been injected into other beans in its raw version as part of a circular reference

 

Resolved by referring to:

1. https://www.baeldung.com/circular-dependencies-in-spring#2-use-lazy
2. https://blog.51cto.com/u_13478207/3336383

has been injected into other beans in its raw version as part of a circular reference, but has eventually been wrapped. This means that said other beans do not use the final version of the bean. This is often the result of over-eager type matching - consider using 'getBeanNamesOfType' with the 'allowEagerInit' flag turned off, for example.

structure to tell the story...

@Service

public class MainService{

    @Autowired

    private ServiceParent

}

@Service

public class ServiceParent{

    @Autowired

    private ServiceChild

    

}

@Service

public class ServiceChild{

    @Autowired

    private ServiceParent

    

}

then will hit the exception while maven run the application locally/at server.

@Service

public class ServiceChild{

    @Autowired

    @Lazy

    private ServiceParent

    

}

Keycloak 18.0.2

 

HTTP Error

302

401

500

clientId missing

solved by changing json config from installation as below

from:

  "auth-server-url": "http://localhost:9000/",

  "ssl-required": "none",

  "resource": "localsfaportal",

to:

  "url": "http://localhost:9000/",

  "ssl-required": "none",

  "clientId": "localsfaportal",

       [KEYCLOAK] Usage of legacy style promise methods such as `.error()` and `.success()` has been deprecated and support will be removed in future versions. Use standard style promise methods such as `.then() and `.catch()` instead.

resolved by changing init javascript

from:

keycloak.init().success().error()

to:

keycloak.init().then().catch()

has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Solved by adding * as print screen below:

Upgrade Spring Boot from 1.5.20.RELEASE to 2.7.2

as of: 20220727_pm070452, Still editing...

Stacks

From Spring Boot + Keycloak

To: Spring Boot + Keycloak + Spring Security 

Version

from: 1.5.20.RELEASE

to: 2.7.2

Changes

1. pom.xml
2. CSRF - default implementation of Spring Security
1. JSP
3. Controllers
4. Services
1. Repo
1. Batch Save
2. Batch Delete
3. Delete
4. FindOne
5. Pageable
5. application.properties
6. 
   

pom.xml

Added

<dependency>

<groupId>org.springframework.security</groupId>

<artifactId>spring-security-config</artifactId>

</dependency>

<dependency>

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-security</artifactId>

</dependency>

<dependency>

<groupId>org.keycloak</groupId>

<artifactId>keycloak-spring-boot-starter</artifactId>

<version>18.0.2</version>

</dependency>

<dependency>

<groupId>org.keycloak</groupId>

<artifactId>keycloak-spring-security-adapter</artifactId>

<version>18.0.2</version>

</dependency>

<dependency>

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-validation</artifactId>

</dependency>

<dependency>

<groupId>org.keycloak.bom</groupId>

<artifactId>keycloak-adapter-bom</artifactId>

<version>${version.keycloak-adapter-bom}</version>

<type>pom</type>

</dependency>

Modified

from:

  <parent>

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-parent</artifactId>

<version>1.5.20.RELEASE</version>

</parent>

to:

  <parent>

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-parent</artifactId>

<version>2.7.2</version>

</parent>

from:

<properties>

<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>

<java.version>1.8</java.version>

<spring-cloud.version>Edgware.SR5</spring-cloud.version>

</properties>

to:

<properties>

<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>

<java.version>1.8</java.version>

<start-class>com.tiongnam.sfa.cdr.MainClass</start-class>

<spring-cloud.version>2021.0.3</spring-cloud.version>

<version.keycloak-adapter-bom>18.0.2</version.keycloak-adapter-bom>

</properties>

from:

<dependency>

<groupId>org.keycloak</groupId>

<artifactId>keycloak-spring-boot-adapter</artifactId>

<version>4.5.0.Final</version>

</dependency>

to:

<dependency>

<groupId>org.keycloak</groupId>

<artifactId>keycloak-spring-boot-adapter</artifactId>

<version>18.0.2</version>

</dependency>

CSRF - default implementation of Spring Security

Added header into ajax post request

, headers: {"${_csrf.headerName}": '${_csrf.token}'}

Added spring security tag within POST form:

<sec:csrfInput />

or

turn off csrf checking

protected void configure(HttpSecurity http) throws Exception {

org.springframework.security.config.annotation.web.builders.HttpSecurity http.csrf().disable();

...

...

Controllers:

Changed

From:

org.keycloak.KeycloakPrincipal<RefreshableKeycloakSecurityContext> principal

To:

java.security.Principal principal

Services

Batch Save

Changed

From:

repo.save(batchList)

To:

repo.saveAll(batchList);

findOne

From:

repo.findOne(new Long("1"));

To:

repo.getReferenceById(new Long("1"));

Delete

From:

delete(entity.getId());

To:

deleteById(entity.getId());

Pageable

From:

Pageable page_req = new PageRequest(index,reqData.getLength(), orderBy(reqData), reqData.getOrder().getData());

To:

Pageable page_req = PageRequest.of(index, reqData.getLength(), orderBy(reqData), reqData.getOrder().getData());

application.properties

Added

server.tomcat.max-http-form-post-size

server.tomcat.max-swallow-size

Changed

server.contextPath

to

server.servlet.context-path

spring.http.multipart.max-file-size

to

spring.servlet.multipart.max-file-size

spring.http.multipart.max-request-size

to

spring.servlet.multipart.max-request-size

keycloak.securityConstraints[0].authRoles[0]=read-only-common

keycloak.securityConstraints[0].securityCollections[0].patterns[0]=/welcome

keycloak.securityConstraints[0].securityCollections[0].patterns[1]=/logout

keycloak.securityConstraints[0].securityCollections[0].patterns[2]=/dashboard

keycloak.securityConstraints[0].securityCollections[0].patterns[3]=/web/getDashboard

to

@Override

protected void configure(HttpSecurity http) throws Exception {

super.configure(http);

http.authorizeRequests()

.antMatchers("/vendor/**", "/css/**", "/js/**", "/img/**").permitAll()

.antMatchers("/upload").authenticated()

.antMatchers("/formd/**", "/module1/**", "/maintenance/**").authenticated()

.anyRequest().authenticated()

;

}

ajax, upload file, json string, Spring Controller, DTO

 



Googled: json to dto spring boot controller




Resolved by follow the example on: 

Spring Boot controller - Upload Multipart and JSON to DTO

thread solution at: https://stackoverflow.com/a/49993072


Ajax Javascript

formData.append( 'dtoName', new Blob([JSON.stringify(dtoJavascriptObject)], {

type: "application/json"

}));

Spring Controller parameter

@RequestPart ManualGenerateCsv dtoName

couldn't parse json attribute to java object attribute.

 

private boolean isRequiredFtpToSSS;

public void setRequiredFtpToSSS(boolean isRequiredFtpToSSS) {

this.isRequiredFtpToSSS = isRequiredFtpToSSS;

}

Since your attribute name: isRequiredFtpToSSS

Due to jackson is expecting: setIsRequiredFtpToSSS

But there has no "is for the auto generated setter: setRequiredFtpToSSS

So u have to add this.

@JsonProperty("isRequiredFtpToSSS")

private boolean isRequiredFtpToSSS;

Jackson JSON parsing from string to date.

 

@JsonFormat(pattern = "yyyy-MMM-dd")

private Date dateFrom;

not sure if were causing by:

MethodArgumentConversionNotSupportedException when I try to map json string onto java domain class in Spring controller's method

jquery 3.3.1 change checkbox checked

 







Found: 

Make checkbox value checked with jQuery or JavaScript

but seems not the same case.

the one i'm using.

$("#chkHasDateTo").prop('checked', dto.hasDateTo);

But i remember there are more elegant way to do the same thing....

Jquery Datepicker: click on a checkbox, then open/pop datepicker of a textbox.

 


click on a checkbox, then open/pop datepicker of a textbox.

if($("#chkHasDateTo").is(":checked")){

$( "#dateTo" ).trigger( "select" );

$( "#dateTo" ).trigger( "focus" );

}

全 #Lesley [Legend V] #MVP 7.7/6 4 6 | $13383 202206142025

 




全 #Lesley [Legend V] #MVP 7.7/6 4 6 | $13383 202206142025 https://youtu.be/tnp0nELuY8Q via @YouTube #MLBB