title: spring gateway server fail when gateway server protected witeh csrf and request content type is application/x-www-form-urlencoded
body: <h1>spring gateway server cannot get response from upsteam server when gateway server protected witeh csrf and request content type is application/x-www-form-urlencoded</h1>
  <p>there are two simple server.</p>
  <h2>the 1st is gateway server.</h2>
  <p>it's only import gateway and security.</p>
  <pre class="lang-xml prettyprint-override"><code>&lt;dependency&gt;
      &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
  &lt;/dependency&gt;
  &lt;dependency&gt;
      &lt;groupId&gt;org.springframework.cloud&lt;/groupId&gt;
      &lt;artifactId&gt;spring-cloud-starter-gateway&lt;/artifactId&gt;
  &lt;/dependency&gt;
  </code></pre>
  <p>and it's security config like this. they are very simple. so i write them in the same class</p>
  <pre class="lang-java prettyprint-override"><code>@SpringBootApplication
  public class GatewayApplication {
  
      public static void main(String[] args) {
          SpringApplication.run(GatewayApplication.class, args);
      }
      @Bean
      public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
          http.authorizeExchange().anyExchange().permitAll();
          http.csrf().csrfTokenRepository(CookieServerCsrfTokenRepository.withHttpOnlyFalse());
          return http.build();
      }
      /**
       * add csrf cookie response on every response
       * @return
       */
      @Bean
      public WebFilter addCsrfTokenFilter() {
          return (exchange, next) -&gt; Mono.just(exchange)
                  .flatMap(ex -&gt; ex.&lt;Mono&lt;CsrfToken&gt;&gt;getAttribute(CsrfToken.class.getName()))
                  .doOnNext(ex -&gt; {
                  })
                  .then(next.filter(exchange));
      }
  }
  </code></pre>
  <p>the gateway routes</p>
  <pre class="lang-yaml prettyprint-override"><code>spring:
    cloud:
      gateway:
        routes:
          - id: test
            uri: http://localhost:8888
            predicates:
              - Path=/test/**
            filters:
              - StripPrefix=1
  </code></pre>
  <h1>the 2nd is an upstream server</h1>
  <p>it is a simple web server</p>
  <pre class="lang-java prettyprint-override"><code>@SpringBootApplication
  @RestController
  public class UpstreamApplication {
  
  
      @PostMapping(&quot;/test&quot;)
      public String postData(Dto dto) {
          return &quot;post success&quot;;
      }
  
      public static void main(String[] args) {
          SpringApplication.run(UpstreamApplication.class, args);
      }
  
  }
  </code></pre>
  <p>the dto class has 2 properties a and b</p>
  <pre class="lang-java prettyprint-override"><code>public class Dto {
      private String a;
      private String b;
  
      public String getA() {
          return a;
      }
  
      public void setA(String a) {
          this.a = a;
      }
  
      public String getB() {
          return b;
      }
  
      public void setB(String b) {
          this.b = b;
      }
  }
  </code></pre>
  <p>and i config the server start on port 8888</p>
  <pre class="lang-yaml prettyprint-override"><code>server:
    port: 8888
  </code></pre>
  <p>and then ,i use post man to test them.
  the 1st time ,i have no csrf value.</p>
  <pre><code>curl --location --request POST 'http://localhost:8080/test/test' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'a=1' \
  --data-urlencode 'b=2'
  </code></pre>
  <p>the server response the invalidate csrf token exception.
  and then i get csrf token value from cookie values.
  and then i send request with csrf header.</p>
  <pre class="lang-sh prettyprint-override"><code>curl --location --request POST 'http://localhost:8080/test/test' \
  --header 'X-XSRF-TOKEN: f8db31f3-8be6-4103-8e15-5ef4594a08f0' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --header 'Cookie: XSRF-TOKEN=f8db31f3-8be6-4103-8e15-5ef4594a08f0' \
  --data-urlencode 'a=1' \
  --data-urlencode 'b=2'
  </code></pre>
  <p>the client is wait for response more than 3 minutes and not completed.</p>
  <p>i test the other content type ,they are completed normal.</p>
  <p>if the upstream server's function params is empty or the client request params is empty. it can be completed.</p>
  <p>the test project is here <a href="https://github.com/ldwqh0/spring_gateway_csrf_bug" rel="nofollow noreferrer">https://github.com/ldwqh0/spring_gateway_csrf_bug</a></p>