I am upgrading my jhipster application to the latest jhipster version which is 7.6.0. Jhipster 7.6.0 introduces latest version of spring boot (2.6.3) and spring framework (5.3.15)
For security configuration class, I am still using the annotations from spring web mvc and I am not using spring web reactive. At this point, I dont want to switch to web reactive.
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
@Import(SecurityProblemSupport.class)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter { }
After compiling, building and starting my application, If I hit the login url, then I get below error on the screen
Login with OAuth 2.0
[invalid_user_info_response] An error occurred while attempting to retrieve the UserInfo Resource: 403 Forbidden: [no body]
Browser's DevTools console shows that OAuth/authorization end point is returning with 200 http status with no values for session id and token, whereas ideally the end point should return with http status 302 along with session id and token.
I suspect, its related to the changes introduced by the version upgrade, because If I switch back to the older branch of the source code (having older version of jhipster like 6.4.1 and spring) , then the login works just fine.
Can anyone suggest what could be the possible reason behind this issue? I believe that the 'authorize' end point returning 200 response with missing session id and token is surely one of the reasons. Please guide me on this.
Thanks.
SameSite
cookie attribute. This could be causing the behaviour you described. You can try setting the following propertyserver.servlet.session.cookie.same-site=none
and see if it makes your application run as expected. If this is the cause you can decide how to proceed based on the information provided in the linked documentation.