A mutating operation changes stored data or other server-side state. In browser applications, CSRF protection requires these requests to carry a token so a foreign page cannot act as the logged-in user. section 9.1 section 9.2
Spring Security handles mutation requests through this sequence:
- Allow GET, HEAD, TRACE, and OPTIONS requests without a CSRF token. section 9.1
- Generate a token when the user first loads a page with an HTTP GET request. section 9.1
- Require POST, PUT, DELETE, and other mutating requests to return the token in a header or form field. section 9.1 section 9.2
- Reject a missing or incorrect token with HTTP 403 Forbidden. section 9.1
Protecting a product form
A POST endpoint such as /product/add is rejected until the Thymeleaf form includes a hidden input containing ${_csrf.parameterName} and ${_csrf.token}; after that, the controller action runs. section 9.2
Figure 9.2 To make a POST request, the client needs to add a header containing the CSRF token. The application generates a CSRF token when the page is loaded (via a GET request), and the token is added to all requests that can be made from the loaded page. This way, only the loaded page can make mutating requests.
Shows how a page-loaded token is added to POST requests so only the loaded application page can perform mutations. section 9.1
