For most of web developers
You may have noticed that the Spring boot property
security.enable-csrf would take care of enabling and disabling this feature. Nonetheless its meant to be on by default and to disable it you must do it by Java or xml code.
The property alternative could be a great way so you can, for instance create a profile that disable this security protection, so you can focus in the actual functionality
Property working in newer versions: Based on a comment of a Spring Boot member this issue is fixed on new versions of Spring: I had it on version
1.5.2.RELEASE but it seems that in version 1.5.9.RELEASE (the latest stable one to the date before version 2) its already fixed and by default csrf is disabled and it can be enabled with
security.enable_csrf: true. Therefore a possible solution could be just upgrading to version
1.5.9.RELEASE, before making a major one to version 2 where the architecture might be quite more different. The solution that will be presented is compatible with any version.
WebSecurityConfigurerAdapter uses an imperative approach you can inject the value of the
security.enable-csrf variable and disable CSRF when it be false. You are right, I think this should work out of the box.
What I did was to set that variable to false in my application.yml for when I had a dev spring profile active, although you could create a profile called nosecurity for such purposes too. It eases this process a lot:
I hope it suits your needs
- How to disable csrf in Spring using application.properties? in StackOverflow.
- Closed issue in Github.
- CSRF Configuration in Spring Security.
Cross-site request forgery in Wikipedia.