liveBook · Manning

Hidden field

As explained in Spring Security in Action, Second Edition

A hidden input is an HTML form control whose value is submitted with the form but is not displayed to the user.

A hidden field is an HTML form control whose value is submitted with the form without being displayed. In a Spring Security application, it carries a CSRF token required by protected state-changing requests. section 9.2

Use a hidden field when:

  • A custom POST, PUT, or DELETE form must include the CSRF token. section 9.2
  • A form submits a value that should not appear as an editable or visible control. section 9.2

Spring Security and Thymeleaf

Add an input with type="hidden", bind its name to ${_csrf.parameterName}, and bind its value to ${_csrf.token}. Without it, the POST to /product/add receives HTTP 403 Forbidden; with it, the controller executes.

How Spring Security in Action, Second Edition covers it

How deep it goes
Demonstrates declaration, template binding, request rejection, and successful controller execution, but does not explore hidden-field security beyond CSRF transport.
Examples
Uses the default login form and a product-add form posting to /product/add.
What it assumes
Assumes basic HTML forms and Spring MVC, while demonstrating CSRF token handling through a concrete application.
What you can do after
Apply it via Thymeleaf to make custom Spring Security forms pass CSRF validation.
How it connects
Connects HTML forms with CSRF protection, Spring Security, and Thymeleaf.
Cover of Spring Security in Action, Second Edition
liveBookmanning.com
Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.