How to selectively disable CSRF check in Play Framework 2 (Java)

Question

In Play Framework we can apply global CSRF check

@SuppressWarnings({ "rawtypes", "unchecked" })
@Override
public <T extends EssentialFilter> Class<T>[] filters() {
    Class[] filters = { CSRFFilter.class };

    return filters;
}

Which is fine in most of the cases. But I want to setup Facebook Canvas page which points to our website. The thing is Facebook sends POST request to our site and it is prevented by the CSRF check. It always return "Invalid CSRF Token"

So I want to selectively disable CSRF check in some actions say www.ourwebsite.com/canvas

Is this feasible?

Answer 1

I created a blog post on how to do this, see here:

http://dominikdorn.com/2014/07/playframework-2-3-global-csrf-protection-disable-csrf-selectively/

2017-Update: Starting with PlayFramework 2.6, this is now included in the Framework itself: https://www.playframework.com/documentation/2.6.x/JavaCsrf#applying-a-global-csrf-filter