{"action":"created","issue":{"url":"https://api.github.com/repos/pac4j/play-pac4j/issues/142","repository_url":"https://api.github.com/repos/pac4j/play-pac4j","labels_url":"https://api.github.com/repos/pac4j/play-pac4j/issues/142/labels{/name}","comments_url":"https://api.github.com/repos/pac4j/play-pac4j/issues/142/comments","events_url":"https://api.github.com/repos/pac4j/play-pac4j/issues/142/events","html_url":"https://github.com/pac4j/play-pac4j/issues/142","id":180496828,"number":142,"title":"CSRF validation fails with form-posted parameter","user":{"login":"djriffel","id":4506022,"avatar_url":"https://avatars.githubusercontent.com/u/4506022?v=3","gravatar_id":"","url":"https://api.github.com/users/djriffel","html_url":"https://github.com/djriffel","followers_url":"https://api.github.com/users/djriffel/followers","following_url":"https://api.github.com/users/djriffel/following{/other_user}","gists_url":"https://api.github.com/users/djriffel/gists{/gist_id}","starred_url":"https://api.github.com/users/djriffel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/djriffel/subscriptions","organizations_url":"https://api.github.com/users/djriffel/orgs","repos_url":"https://api.github.com/users/djriffel/repos","events_url":"https://api.github.com/users/djriffel/events{/privacy}","received_events_url":"https://api.github.com/users/djriffel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2016-10-02T05:40:33Z","updated_at":"2016-10-25T07:02:00Z","closed_at":null,"body":"I'm not sure if I'm missing something here, or if the library is erroneously dropping the CSRF parameter from a form-body post. I always get forbidden when using the \"csrfCheck\" authorizer when coming from a form posting action that was wrapped with a \"csrfToken\" authorizer.\r\n\r\nHere's what I found in my digging:\r\n\r\nWhen using the org.pac4j.play.scala.Security.Secure() method, the WebContext is getting created via the RequestHeader constructor method, when called on line 78 of Security.scala. Following the trail, you can see the request body (and thus the csrf in the form parameters) is getting dropped when instantiating this web context. \r\n\r\nSecurity.scala line 78 leads to org.pac4j.play.PlayWebContext.java line 50:\r\n\r\n    JavaHelpers$.MODULE$.createJavaContext(requestHeader), sessionStore);\r\n\r\n..which leads to play.core.j.JavaHelpers.scala line 85:\r\n\r\n    new JRequestImpl(req)\r\n\r\n..which brings us to play.mvc.Http.java line 678 (\"this.underlying\" refers to the underlying Request instance of the RequestImpl class, which would have all the body parameters. When not supplied, we are getting only the header data):\r\n\r\n    this.underlying = null;\r\n\r\nI was able to fix this issue by changing how the WebContext was instantiated in the Security trait. I'm not sure if there's an easier way to accomplish this, as the documentation is either very sparse on converting from Scala to Java request classes, or my google-fu is severely failing me.\r\n\r\nIn org.pac4j.play.scala.Security.scala on line 78, replace `val webContext = new PlayWebContext(request, playSessionStore)` with the following:\r\n\r\n    val javaBodyContent = request.asInstanceOf[Request[AnyContent]].body.asFormUrlEncoded\r\n      .getOrElse(Map.empty[String, Seq[String]])\r\n      .map(field => field._1 -> field._2.toArray)  // Make field values Java-friendly\r\n      .asJava\r\n\r\n    val javaBody = new RequestBody(javaBodyContent)\r\n    val jRequest = Request(request, javaBody)\r\n    val jContext = JavaHelpers.createJavaContext(jRequest)\r\n\r\n    val webContext = new PlayWebContext(jContext, playSessionStore)\r\n\r\nFor your reference, I am using Play 2.5.8 with play-pac4j 2.5.0 and pac4j-oidc 1.9.2."},"comment":{"url":"https://api.github.com/repos/pac4j/play-pac4j/issues/comments/255953567","html_url":"https://github.com/pac4j/play-pac4j/issues/142#issuecomment-255953567","issue_url":"https://api.github.com/repos/pac4j/play-pac4j/issues/142","id":255953567,"user":{"login":"vjkoskela","id":1775197,"avatar_url":"https://avatars.githubusercontent.com/u/1775197?v=3","gravatar_id":"","url":"https://api.github.com/users/vjkoskela","html_url":"https://github.com/vjkoskela","followers_url":"https://api.github.com/users/vjkoskela/followers","following_url":"https://api.github.com/users/vjkoskela/following{/other_user}","gists_url":"https://api.github.com/users/vjkoskela/gists{/gist_id}","starred_url":"https://api.github.com/users/vjkoskela/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vjkoskela/subscriptions","organizations_url":"https://api.github.com/users/vjkoskela/orgs","repos_url":"https://api.github.com/users/vjkoskela/repos","events_url":"https://api.github.com/users/vjkoskela/events{/privacy}","received_events_url":"https://api.github.com/users/vjkoskela/received_events","type":"User","site_admin":false},"created_at":"2016-10-25T07:02:00Z","updated_at":"2016-10-25T07:02:00Z","body":"Hi, not sure if this is related, but I would like to configure the Pac4J ```CallbackController``` to enforce the Play standard CSRF (e.g. as enabled via ```@RequireCSRFCheck```) on POST. Is this accomplished by adding the csrfAuthorizer as shown in your patch to play-pac4j-java-demo above?"}}
{"actor":{"display_login":"vjkoskela"}}