Spring MVC : How to Protect Application from CSRF and XSS

Question

What is the best way to protect our Spring MVC application from CSRF and XSS.

Is there native Spring MVC support for this?

Answer 1

In Spring:

Forms ( globally):

<context-param>
<param-name>defaultHtmlEscape</param-name>
<param-value>true</param-value>
</context-param>

Forms ( locally):

<spring:htmlEscape defaultHtmlEscape="true" />

Answer 2

You can use Spring Security 3.2.0.RELEASE and enable csrf support with this configuration

<http>
    <!-- ... -->
    <csrf />
</http>