'/csrf' 401 and '/' 404 when loading swagger-ui.html

• What version of the library are you using? It is the latest version.

What kind of issue is this?

• Support needed. @dilipkrish

Additional details:

• Browser: Google Chrome
• IDE: IntelliJ IDEA: Ultimate 2019.2
• Java: 1.8
• Spring Boot: Latest - 2.2.1
• Spring Boot Stater Security: Latest - 2.2.1
• Spring Security Test: Latest - 5.2.1

When I try to load http://localhost:server.port/swagger-ui.html page loads but with inspect I see this two bad requests:

On server side it throws an exception: org.springframework.security.access.AccessDeniedException: Access is denied.

I tried with debug mode and it looks like the problem is in: JwtAuthenticationFilter -> doFilterInternal(...) -> filterChain.doFilter(request, response);. Also bearerToken is null.

I tried to follow this tutorial: Part1 and Part2 and add Swagger to the project.

I am not sure if this is a normal behavior. I also checked some similar issues on this channel also on stackoverflow like this with no result.

[rsteaburdea]

In #2639 I found a comment of @matthewh86 where he bypassed server side errors by adding .antMatchers("/", "/csrf").permitAll() to HttpSecurity http but how he said if feels like

hacky

Also I still have this two errors in browser:

csrf is disabled for http and I have an AuthWhiteList for

// -- swagger ui
"/swagger-resources/**",
"/swagger-ui.html",
"/v2/api-docs",
"/webjars/**",
"/configuration/ui",
"/configuration/security"

[dilipkrish]

For everyones benefit, outside of the permit all fix for the 401 error, the reason we see the 404 is that the /csrf endpoint doesn’t exit. The only reason for its existence is to return a cookie based csrf token that swagger ui uses.