H2 database console spring boot Load denied by X-Frame-Options

Question

I`m building a skeletal project for dev with spring 4 boot security and others. Using H2 while attempting to log into the db console and manage my db i get the following error. The page is blank, with 4 bugs in firebug konsole :

 Load denied by X-Frame-Options: http://localhost:8080/console

With links to

/header.jsp?jsessionid=f71207a702c9177e57208414721bbe93 does not permit framing.
/query.jsp?jsessionid=f71207a702c9177e57208414721bbe93 does not permit framing.
/help.jsp?jsessionid=f71207a702c9177e57208414721bbe93 does not permit framing.
/tables.do?jsessionid=f71207a702c9177e57208414721bbe93 does not permit framing.

1. I can test the connection from console level - its ok.
2. DB works fine, import.sql works fine, i can create user entities withing spring is starting up.

The configuration i am using is from (and it works on spring 3.2 with xml configuration)

spring boot default H2 jdbc connection (and H2 console)

Using : spring-boot-starter-parent 1.1.4.RELEASE

Unswear

Added .and().headers() .addHeaderWriter(new XFrameOptionsHeaderWriter( new WhiteListedAllowFromStrategy(Arrays.asList("localhost:8080","http://localhost")))) White page and info to refresh to page to get the source code. – Poach

Answer 1

Added the code below to Application.java and for now it works, default on port 8082, starts with spring app. It doesn`t hit the spot but for dev purposes it is all ok.

@Bean
org.h2.tools.Server h2Server() {
    Server server = new Server();
    try {
        server.runTool("-tcp");
        server.runTool("-tcpAllowOthers");
    } catch (Exception e) {
        e.printStackTrace();
    }
    return server;

}

Unswear

Nice but is automatically starting h2 in browser on startup, is there a way to avoid it? – Disenthrall

I spent 3 hours trying to make it work via Spring Security and could not. This did the trick! – Zoo

Answer 2

It's also possible to simplify the answer from @chrosciu with this:

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http.headers().frameOptions().disable();
  }
}

Hardset

Or, more securely, headers().frameOptions().sameOrigin(). – Torchier

Answer 3

This worked for me:

@EnableWebSecurity
@Configuration
class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.headers().addHeaderWriter(
            new XFrameOptionsHeaderWriter(
                new WhiteListedAllowFromStrategy(Arrays.asList("localhost"))));
    }
}

Of course contents of white list should be adjusted in case when application is running on something different than localhost.

Chieftain

Even better solution: http.headers().addHeaderWriter(new XFrameOptionsHeaderWriter(XFrameOptionsMode.SAMEORIGIN)); This does not require to explicite state host name in secuiryty config – Chieftain

Even better: .headers().frameOptions().sameOrigin() – Inebriety

Answer 4

With new spring dsl you can use headers method in SecurityFilterChain as below

@Configuration
@EnableWebSecurity
public class SecurityConfiguration  {

  @Bean
  SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {

    http.headers(headers -> headers.frameOptions().disable()) //disable frame
        //rest of your configuration
        .csrf( csrf -> csrf.disable())
        .authorizeHttpRequests(
                    authorize -> authorize
                            .requestMatchers(HttpMethod.OPTIONS).permitAll()
                            .requestMatchers(HttpMethod.POST, "/users", "/users/login").permitAll()
                            .requestMatchers(HttpMethod.GET, "/articles/**").permitAll()
                            .anyRequest().permitAll()
            )
          
        return http.build();
  }

Toadflax

Answer 5

Most answers are fine but they do mess with the security config for the entire application, not only the H2 console. A better way - assuming a development environment - would therefore be to simply add an exception to the entire security config:

@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
  http
    // exclude H2 requests
    .requestMatcher(
      new NegatedRequestMatcher(new AntPathRequestMatcher("/h2-console/**"))
    )
    // default security config
    .authorizeRequests()
      .anyRequest().authenticated();
}

Crossarm

Answer 6

You need to add this

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
                .headers(AbstractHttpConfigurer::disable)
           ...

Fought