title: OAuth2 with Implicit client and csrf protection
body: <p>I have an API I want to secure with OAuth2. I already did a dummy test with the password grant_type and everything works. I can request tokens, access secured endpoints with it, etc. The server acts as the authorization and resource server.</p>
  
  <p>Later on I read that I should be using the implicit grant_type as the client will be a javascript app.</p>
  
  <p>My client is configured like so:</p>
  
  <pre><code>@Override
  public void configure(final ClientDetailsServiceConfigurer clients) throws Exception {// @formatter:off
  clients
      .inMemory().withClient("web")
      .redirectUris("http://localhost:3000")
      .secret("secret")
      .authorizedGrantTypes("implicit", "refresh_token").scopes("read", "write")
      .accessTokenValiditySeconds(3600).refreshTokenValiditySeconds(2592000);
  }
  </code></pre>
  
  <p>If I try accessing the endpoint like this:
  <a href="http://localhost:8080/oauth/authorize?grant_type=implicit&amp;client_id=web&amp;response_type=token&amp;redirect_uri=http%3A%2F%2Flocalhost%3A3000" rel="nofollow">http://localhost:8080/oauth/authorize?grant_type=implicit&amp;client_id=web&amp;response_type=token&amp;redirect_uri=http%3A%2F%2Flocalhost%3A3000</a></p>
  
  <p>I get this:</p>
  
  <pre><code>{
    "timestamp": 1464136960414,
    "status": 403,
    "error": "Forbidden",
    "message": "Expected CSRF token not found. Has your session expired?",
    "path": "/oauth/authorize"
  }
  </code></pre>
  
  <p>How can I have a CSRF token if it's the first time I'm calling the API?
  If (just for testing) I disable csrf then I get this:</p>
  
  <pre><code>{
    "timestamp": 1464136840865,
    "status": 403,
    "error": "Forbidden",
    "exception": "org.springframework.security.authentication.InsufficientAuthenticationException",
    "message": "Access Denied",
    "path": "/oauth/authorize"
  }
  </code></pre>
  
  <p>Setting the client with the password grant_type I'm able to make this call and everything works:
  <a href="http://localhost:8080/oauth/token?grant_type=password&amp;username=test&amp;password=123" rel="nofollow">http://localhost:8080/oauth/token?grant_type=password&amp;username=test&amp;password=123</a>
  And adding the Authorization Basic header with the client id/secret.</p>
  
  <p>Just to clarify, the idea is to have this unique trusted client. So the user should just input login/password without asking the user to grant access rights to the app.</p>
  
  <p>Sorry if this is a dumb question. I've been reading everything I can find but cannot seem to make progress with it.</p>
  
  <p>Thanks!</p>
  
  <p>EDIT:</p>
  
  <p>My Spring Security Config:</p>
  
  <pre><code>@Configuration
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
    @Autowired
    private MongoDBAuthenticationProvider authenticationProvider;
  
    @Autowired
    public void globalUserDetails(final AuthenticationManagerBuilder auth) throws Exception {
      auth.authenticationProvider(authenticationProvider);
    }
  
    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
      return super.authenticationManagerBean();
    }
  }
  </code></pre>
  
  <p>My OAuth Config:</p>
  
  <pre><code>@Configuration
  @EnableAuthorizationServer
  public class OAuth2AuthorizationServerConfig extends     AuthorizationServerConfigurerAdapter {
  
    @Autowired
    @Qualifier("authenticationManagerBean")
    private AuthenticationManager authenticationManager;
  
    @Override
    public void configure(final AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
          oauthServer.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()");
    }
  
    @Override
    public void configure(final ClientDetailsServiceConfigurer clients) throws Exception {
      clients
      .inMemory().withClient("web")
      .redirectUris("http://localhost:3000")
      .secret("secret")
      .authorizedGrantTypes("implicit", "refresh_token").scopes("read", "write")
      .accessTokenValiditySeconds(3600).refreshTokenValiditySeconds(2592000);
    }
  
    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints)     throws Exception {
      endpoints.authenticationManager(authenticationManager);
    }  
  }
  </code></pre>
  
  <p>Exception in Server:</p>
  
  <pre><code>2016-05-25 19:52:20.744 DEBUG 34968 --- [nio-8080-exec-5] .s.o.p.e.FrameworkEndpointHandlerMapping : Looking up handler method for path /oauth/authorize
  2016-05-25 19:52:20.744 DEBUG 34968 --- [nio-8080-exec-5] .s.o.p.e.FrameworkEndpointHandlerMapping : Returning handler method [public org.springframework.web.servlet.ModelAndView org.springframework.security.oauth2.provider.endpoint.AuthorizationEndpoint.authorize(java.util.Map&lt;java.lang.String, java.lang.Object&gt;,java.util.Map&lt;java.lang.String, java.lang.String&gt;,org.springframework.web.bind.support.SessionStatus,java.security.Principal)]
  2016-05-25 19:52:20.746 DEBUG 34968 --- [nio-8080-exec-5] o.s.s.w.a.ExceptionTranslationFilter     : Authentication exception occurred; redirecting to authentication entry point
  
  org.springframework.security.authentication.InsufficientAuthenticationException: User must be authenticated with Spring Security before authorization can be completed.
  at     org.springframework.security.oauth2.provider.endpoint.AuthorizationEndpoint.authorize(AuthorizationEndpoint.java:138) ~[spring-security-oauth2-2.0.9.RELEASE.jar:na]
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_40]
  at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_40]
  ....
  </code></pre>