Csrf protection

As explained in Spring Security in Action, Second Edition

CSRF protection is a web-security mechanism that prevents forged state-changing requests from an authenticated user's browser.

CSRF protection prevents a forged page from using an authenticated user's browser to perform unwanted state-changing actions. Spring Security enables it by default, so an HTTP POST without a valid CSRF token is rejected with HTTP 403. section 9.0 section 9.1

The protection mechanism issues a token when a page loads, then requires clients to send that token with mutating requests. CsrfFilter validates the request through a CsrfTokenRepository before allowing the filter chain to continue. section 9.1

Apply the mechanism in this sequence:

• Keep CSRF protection enabled for browser-based web applications whose pages and state-changing endpoints are served by the same application. section 9.2
• Include the token in every mutating request; HTML forms can submit it as a hidden input using `${_csrf.parameterName}` and `${_csrf.token}`. section 9.2
• Use the default protection for non-GET, non-HEAD, non-TRACE, and non-OPTIONS requests unless a specific application requirement justifies customization. section 9.3
• Exclude selected paths with `ignoringRequestMatchers`, or replace token storage and request handling through the CSRF configuration. section 9.3 section 9.4

Protected POST endpoint

A `/hello` POST endpoint returns HTTP 403 when called without a token. After a GET obtains the token, a request carrying the session cookie and `X-CSRF-TOKEN` succeeds. A Thymeleaf form achieves the same result with a hidden CSRF input.

Custom token persistence

A custom CsrfTokenRepository can generate a UUID, associate it with an `X-IDENTIFIER` header, and store it through JPA in a database. Later POST requests must send the matching identifier and token.

Figure 9.2 To make a POST request, the client needs to add a header containing the CSRF token. The application generates a CSRF token when the page is loaded (via a GET request), and the token is added to all requests that can be made from the loaded page. This way, only the loaded page can make mutating requests.

Visualizes how a page obtains a CSRF token and attaches it to mutating requests. section 9.1

How Spring Security in Action, Second Edition covers it

How deep it goes

Explains the attack, token exchange, filter placement, form integration, path exclusions, and database-backed repositories.

Examples

Uses Spring MVC forms, REST POST requests, curl commands, hidden inputs, ignored paths, and a JPA/MySQL token repository.

What it assumes

Assumes basic Spring and Java knowledge plus familiarity with Spring Security filter chains, while teaching the CSRF mechanism from its attack scenario.

What you can do after

Configure Spring Security defaults, submit valid tokens, test rejected requests, exclude paths, and implement custom token storage.

How it connects

Connects CSRF tokens with CsrfFilter, filter chains, HTTP methods, form login, REST endpoints, JPA, and OAuth 2.

liveBookmanning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

• cross-site request forgeryaddressed by · Cross-site request forgery is a web attack that induces an authenticated user’s browser to submit an unintended request to a trusted application.
• CSRF tokenuses · A CSRF token is an unpredictable server-issued value required on state-changing requests to verify that they originated from the intended application.
• Spring Securityimplemented by · Spring Security is a Spring framework for implementing application authentication, authorization, access control, and protection against common security threats.
• servlet filteruses · A servlet filter is a web component that intercepts requests and responses to inspect, transform, process, or reject them before or after servlet execution.
• RequestPostProcessorused by · A RequestPostProcessor is a testing component that applies reusable customizations to a simulated HTTP request before execution.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.