Spring Security - CSRF token on GET request

Question

I configured CSRF protection in my Spring 5 (Boot 2) RESTful web service because I want to prevent CSRF attacks (I am using JWT cookie for authentication and authorization). On each request I am getting a new XSRF cookie. The value of that cookie I am sending back through the X-CSRF-TOKEN header.

I noticed that POST, PUT and DELETE methods require the value of this token (in the X-CSRF-TOKEN header) in order to work properly, but GET method works just fine without X-CSRF-TOKEN header.

Is this behavior intentional because GET method should not change state or I did something wrong?

Answer 1

CSRF token is intentionally excluded from GET to avoid token leakage to a 3rd party