How deeply does Spring Security in Action, Second Edition cover CsrfTokenRequestHandler?

Defines the contract and shows filter-chain selection, but does not detail a custom handler implementation.

CsrfTokenRequestHandler

As explained in Spring Security in Action, Second Edition

CsrfTokenRequestHandler is a Spring Security interface for managing how a generated CSRF token is associated with an HTTP request.

CsrfTokenRequestHandler is a Spring Security contract that controls how a generated CSRF token is associated with an HTTP request. It complements CsrfToken, which describes the token, and CsrfTokenRepository, which creates, stores, and loads it. section 9.3 section 9.4

Use it when customizing CSRF token management, such as pairing a database-backed repository with CsrfTokenRequestAttributeHandler in the security filter chain. The repository can store tokens outside the HTTP session, while the handler governs their request-facing association.

Configure a request handler

http.csrf(c -> { c.csrfTokenRepository(customTokenRepository); c.csrfTokenRequestHandler( new CsrfTokenRequestAttributeHandler() ); }); This configuration uses a custom repository and explicitly selects the request handler. A GET request can generate and store a token; a later POST must provide the matching X-CSRF-TOKEN value or receive HTTP 403.

How Spring Security in Action, Second Edition covers it

Cover of Spring Security in Action, Second Edition

liveBook manning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

csrf protectionused by · CSRF protection is a web security mechanism that prevents forged state-changing requests from an authenticated user's browser from being accepted.
CsrfTokenRequestAttributeHandlerincludes · CsrfTokenRequestAttributeHandler is a Spring Security implementation that exposes a generated CSRF token as an HTTP request attribute.
CSRF tokenuses · A CSRF token is an unpredictable server-issued value required on state-changing requests to verify that they originated from the intended application.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.