Menu
Is there a way to disable CSRF token in spring security via XML configuration? I see only java configuration online..can xml based examples. Using spring framework 4.0
590
Disable using security configuration code The spring boot security application allows to configure the security details in a customized class that extends WebSecurityConfigurerAdapter class. The CSRF feature can be disabled using the code “ http. csrf(). disable ()”.
Spring Security by default provides protection against Cross-Site Request Forgery (CSRF) attacks. Disabling it would put the application at risk. Before http.csrf().disable(); After http.csrf(); References. Spring Security docs - CSRF protection.
To protect against CSRF attacks we need to ensure there is something in the request that the evil site is unable to provide so we can differentiate the two requests. Spring provides two mechanisms to protect against CSRF attacks: The Synchronizer Token Pattern. Specifying the SameSite Attribute on your session cookie.
Spring recommend using it when serving browser clients, if not it may be disabled: Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-browser clients, you will likely want to disable CSRF protection.
As of Spring Security 4.0, CSRF protection is enabled by default with XML configuration. If you would like to disable CSRF protection, the corresponding XML configuration can be seen below.
<http> <!-- ... --> <csrf disabled="true"/> </http>CSRF protection is enabled by default with Java configuration. If you would like to disable CSRF, the corresponding Java configuration can be seen below. Refer to the Javadoc of csrf() for additional customizations in how CSRF protection is configured.
@EnableWebSecurity public class WebSecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http .csrf().disable(); } }
See below link http://docs.spring.io/spring-security/site/docs/4.0.x/reference/htmlsingle/#csrf-configure
194
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
