oauth 2.0 - OAuth2 with Implicit client and csrf protection -

i have api want secure oauth2. did dummy test password grant_type , works. can request tokens, access secured endpoints it, etc. server acts authorization , resource server.

later on read should using implicit grant_type client javascript app.

my client configured so:

@override public void configure(final clientdetailsserviceconfigurer clients) throws exception {// @formatter:off clients     .inmemory().withclient("web")     .redirecturis("http://localhost:3000")     .secret("secret")     .authorizedgranttypes("implicit", "refresh_token").scopes("read", "write")     .accesstokenvalidityseconds(3600).refreshtokenvalidityseconds(2592000); } 

if try accessing endpoint this: http://localhost:8080/oauth/authorize?grant_type=implicit&client_id=web&response_type=token&redirect_uri=http%3a%2f%2flocalhost%3a3000

i this:

{   "timestamp": 1464136960414,   "status": 403,   "error": "forbidden",   "message": "expected csrf token not found. has session expired?",   "path": "/oauth/authorize" } 

how can have csrf token if it's first time i'm calling api? if (just testing) disable csrf this:

{   "timestamp": 1464136840865,   "status": 403,   "error": "forbidden",   "exception": "org.springframework.security.authentication.insufficientauthenticationexception",   "message": "access denied",   "path": "/oauth/authorize" } 

setting client password grant_type i'm able make call , works: http://localhost:8080/oauth/token?grant_type=password&username=test&password=123 , adding authorization basic header client id/secret.

just clarify, idea have unique trusted client. user should input login/password without asking user grant access rights app.

sorry if dumb question. i've been reading can find cannot seem make progress it.

thanks!

edit:

my spring security config:

@configuration public class websecurityconfig extends websecurityconfigureradapter {    @autowired   private mongodbauthenticationprovider authenticationprovider;    @autowired   public void globaluserdetails(final authenticationmanagerbuilder auth) throws exception {     auth.authenticationprovider(authenticationprovider);   }    @override   @bean   public authenticationmanager authenticationmanagerbean() throws exception {     return super.authenticationmanagerbean();   } } 

my oauth config:

@configuration @enableauthorizationserver public class oauth2authorizationserverconfig extends     authorizationserverconfigureradapter {    @autowired   @qualifier("authenticationmanagerbean")   private authenticationmanager authenticationmanager;    @override   public void configure(final authorizationserversecurityconfigurer oauthserver) throws exception {         oauthserver.tokenkeyaccess("permitall()").checktokenaccess("isauthenticated()");   }    @override   public void configure(final clientdetailsserviceconfigurer clients) throws exception {     clients     .inmemory().withclient("web")     .redirecturis("http://localhost:3000")     .secret("secret")     .authorizedgranttypes("implicit", "refresh_token").scopes("read", "write")     .accesstokenvalidityseconds(3600).refreshtokenvalidityseconds(2592000);   }    @override   public void configure(authorizationserverendpointsconfigurer endpoints)     throws exception {     endpoints.authenticationmanager(authenticationmanager);   }   } 

exception in server:

2016-05-25 19:52:20.744 debug 34968 --- [nio-8080-exec-5] .s.o.p.e.frameworkendpointhandlermapping : looking handler method path /oauth/authorize 2016-05-25 19:52:20.744 debug 34968 --- [nio-8080-exec-5] .s.o.p.e.frameworkendpointhandlermapping : returning handler method [public org.springframework.web.servlet.modelandview org.springframework.security.oauth2.provider.endpoint.authorizationendpoint.authorize(java.util.map<java.lang.string, java.lang.object>,java.util.map<java.lang.string, java.lang.string>,org.springframework.web.bind.support.sessionstatus,java.security.principal)] 2016-05-25 19:52:20.746 debug 34968 --- [nio-8080-exec-5] o.s.s.w.a.exceptiontranslationfilter     : authentication exception occurred; redirecting authentication entry point  org.springframework.security.authentication.insufficientauthenticationexception: user must authenticated spring security before authorization can completed. @     org.springframework.security.oauth2.provider.endpoint.authorizationendpoint.authorize(authorizationendpoint.java:138) ~[spring-security-oauth2-2.0.9.release.jar:na] @ sun.reflect.nativemethodaccessorimpl.invoke0(native method) ~[na:1.8.0_40] @ sun.reflect.nativemethodaccessorimpl.invoke(nativemethodaccessorimpl.java:62) ~[na:1.8.0_40] .... 

when call authorization server implicit grant type have include opaque string value state parameter avoid csrf attacks. so, request url authorization server like:

http://localhost:8080/oauth/authorize?grant_type=implicit&client_id=web&response_type=token&redirect_uri=http%3a%2f%2flocalhost%3a3000&state=123abc

the value mentioned in state parameter echoed in response. compare echoed value initial value confirm there no csrf attack happened.

thank you, soma.