Spring Boot + Angular monolith application csrf-token is being set as HttpOnly in external...

Locally I get as a response header correctly after GET request

SET-COOKIE: XSRF-TOKEN=cookie; Path=/


And when doing POST request it has cookie and a header and everything is working fine.

In external server where the application is being server over HTTPS the XSRF-TOKEN is being set as

SET-COOKIE: XSRF-TOKEN=cookie; Path=/; Secure; HttpOnly


So that makes the request fail because angular frontend cannot access the cookie to put it into a header.

This is my SecurityConfiguration.java file

.csrf(csrf ->
csrf
.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
.csrfTokenRequestHandler(new SpaCsrfTokenRequestHandler())
.ignoringRequestMatchers(mvc.pattern("/api/logout"))
)
.... some other stuff here
.addFilterAfter(new CookieCsrfFilter(), BasicAuthenticationFilter.class)


In external server I am using default tomcat setup basically.

<Server port="8005" shutdown="SHUTDOWN">

<!-- HTTP to HTTPS redirection -->
<Service name="Catalina">
<Connector port="80" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />


<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="150" SSLEnabled="true">
<SSLHostConfig>
<Certificate certificateFile="crt"
certificateKeyFile="key"
certificateChainFile="crt"
type="RSA" />
</SSLHostConfig>
</Connector>

<Engine name="Catalina" defaultHost="myurl.com">
<Host name="myurl.com" appBase="webapps"
unpackWARs="true" autoDeploy="true">
</Host>
</Engine>
</Service>

</Server>


Can it be that tomcat somehow overwrites these cookies or what are my options here?

Continue reading...