403 errors after upgrading to Spring Security 4.0.0

Question

I've been trying to update my project to Spring Security 4.0.0. I think I've read the migration guide quite extensively but even if I can successfully login and navigate through the pages, I get 403 errors on every Ajax requests. Everything is working fine with 3.2.7.

This is my "manual login" configuration file:

<b:beans xmlns:b="http://www.springframework.org/schema/beans"
    xmlns="http://www.springframework.org/schema/security"
    xmlns:p="http://www.springframework.org/schema/p"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:context="http://www.springframework.org/schema/context"
    xmlns:util="http://www.springframework.org/schema/util"
    xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
    http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd
    http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">

    <!-- HTTP security configurations -->
    <http use-expressions="true" auto-config='true' disable-url-rewriting="false">
        <intercept-url access="permitAll" pattern="/" /><!-- To permit "/" allows the use of web.xml's <welcome-file> -->
        <intercept-url access="permitAll" pattern="/home" />
        <intercept-url access="permitAll" pattern="/login" />
        <intercept-url access="permitAll" pattern="/pages/exceptions/**" />
        <intercept-url access="permitAll" pattern="/javax.faces.resource/**" />
        <intercept-url access="permitAll" pattern="/resources/**" />
        <intercept-url access="permitAll" pattern="/j_spring_security_check"/>
        <intercept-url access="hasRole('ROLE_ADMIN')" pattern="/administration/**" />
        <intercept-url access="isAuthenticated()" pattern="/**" />
        <logout logout-url="/logout" logout-success-url='/home' />
        <form-login login-page='/login'
            username-parameter="j_username"
            password-parameter="j_password"
            login-processing-url="/j_spring_security_check"
            authentication-failure-url="/login?auth=fail"
            default-target-url="/home"  />
    </http>

    <!-- Configure Authentication mechanism -->
    <authentication-manager alias="authenticationManager">
        <authentication-provider ref="${authentication.provider}" />
    </authentication-manager>

    <b:bean name="bcryptEncoder"
        class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" />

    <b:bean id="daoAuthProvider"
        class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
        <b:property name="userDetailsService">
            <b:bean class="eu.ueb.acem.services.auth.DaoUserDetailsService">
                <b:property name="domainService" ref="domainService" />
            </b:bean>
        </b:property>
        <b:property name="passwordEncoder" ref="bcryptEncoder" />
    </b:bean>

</b:beans>

I try to use:

<http use-expressions="true" auto-config='true' disable-url-rewriting="false">
    <headers disabled="true" />
    <csrf disabled="true"/>
    ...
</http>

but I get :

cvc-complex-type.3.2.2: Attribute 'disabled' is not allowed to appear in element 'headers'
cvc-complex-type.3.2.2: Attribute 'disabled' is not allowed to appear in element 'csrf'

which is normal because 4.0.0 has no dedicated XML Schema at:

http://www.springframework.org/schema/security/

So what could possibly cause these "403 forbidden" errors?

Answer 1

Ok, I found the solution. It is indeed to use:

<http use-expressions="true" auto-config='true' disable-url-rewriting="false">
    <csrf disabled="true"/>
    ...
</http>

but for the time being, we have to ignore the XML Schema error in Eclipse. Hopefully Spring will put their new Schema online soon.