Spring Security 3.2 CSRF disable for specific URLs

Question

Enabled CSRF in my Spring MVC application using Spring security 3.2.

My spring-security.xml

<http>  <intercept-url pattern="/**/verify"  requires-channel="https"/>  <intercept-url pattern="/**/login*"  requires-channel="http"/>  ...  ...  <csrf /> </http> 

Trying to disable CSRF for requests that contain 'verify' in request URL.

MySecurityConfig.java

@Configuration @EnableWebSecurity public class MySecurityConfig extends WebSecurityConfigurerAdapter {  private CsrfMatcher csrfRequestMatcher = new CsrfMatcher();  @Override public void configure(HttpSecurity http) throws Exception {      http.csrf().requireCsrfProtectionMatcher(csrfRequestMatcher);  }  class CsrfMatcher implements RequestMatcher {     @Override     public boolean matches(HttpServletRequest request) {          if (request.getRequestURL().indexOf("verify") != -1)             return false;         else if (request.getRequestURL().indexOf("homePage") != -1)                      return false;          return true;     } }  } 

Csrf filter validates CSRF token that is submitted from 'verify' and Invalid token exception (403) is thrown as I'm submitting request to https from http. How can I disable csrf token authentication in such a scenario ?

Answer 1

I know this is not a direct answer, but people (as me) usually don't specify spring's version when searching for this kinds of questions. So, since spring security a method exists that lets ignore some routes:

The following will ensure CSRF protection ignores:

1. Any GET, HEAD, TRACE, OPTIONS (this is the default)
2. We also explicitly state to ignore any request that starts with "/sockjs/"

      http          .csrf()              .ignoringAntMatchers("/sockjs/**")              .and()          ...