{"action":"closed","issue":{"url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/1037","labels_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/1037/labels{/name}","comments_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/1037/comments","events_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/1037/events","html_url":"https://github.com/jhipster/generator-jhipster/issues/1037","id":55483249,"number":1037,"title":"XAuth Authentication is broken","user":{"login":"julienboulay","id":2931221,"avatar_url":"https://avatars.githubusercontent.com/u/2931221?v=3","gravatar_id":"","url":"https://api.github.com/users/julienboulay","html_url":"https://github.com/julienboulay","followers_url":"https://api.github.com/users/julienboulay/followers","following_url":"https://api.github.com/users/julienboulay/following{/other_user}","gists_url":"https://api.github.com/users/julienboulay/gists{/gist_id}","starred_url":"https://api.github.com/users/julienboulay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/julienboulay/subscriptions","organizations_url":"https://api.github.com/users/julienboulay/orgs","repos_url":"https://api.github.com/users/julienboulay/repos","events_url":"https://api.github.com/users/julienboulay/events{/privacy}","received_events_url":"https://api.github.com/users/julienboulay/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-01-26T13:42:16Z","updated_at":"2015-01-26T22:47:14Z","closed_at":"2015-01-26T22:47:14Z","body":"The xauth authentication mechanism is broken, because CSRF protection should be disabled for this authentication type.\r\n\r\nIt seems to be a merge issue coming from this commit 9b6d784254254719e406e654d32d1cc37bc6f610\r\n\r\nAfter the x-auth-token branch has been merged, we missed the following lines in _SecurityConfiguration.java template.\r\n\r\n`<% if (authenticationType == 'xauth') { %>\r\n            .csrf()\r\n            .disable()<% } %>`\r\n\r\nCSRF protection may not be required for token based authentication, as soon as CORS is disabled.\r\n"}}