spring-cloud: Disable CSRF

Question

Tried disabling CSRF in the edge/zuul with http.csrf().disable(). But still csrfFilter is available in filter chain @ position 4. I even have set property spring.enableCsrf: false. Still the csrfFilter kicks in and my ajax requests get 403 error.

How to disable CSRF with Zuul and external OAuth server (UAA)?

are you sure the frontend part is configured as well? for jquery we had to configure something like this to allow cors: `$.ajaxSetup({ xhrFields: { withCredentials: true, cors: true, }, crossDomain: true, dataType: 'json', });` — Paizo, Jul 07 '17 at 10:19
@MukulGoel , Paizo I did this trial a long ago. And I dont have the source code now. Thank you for the responses. — Ahamed Mustafa M, Jul 10 '17 at 09:18

score 0 · Answer 1 · answered Jul 06 '17 at 06:00

Configure CSRF Protection Some frameworks handle invalid CSRF tokens by invaliding the user’s session, but this causes its own problems. Instead by default Spring Security’s CSRF protection will produce an HTTP 403 access denied. This can be customized by configuring the AccessDeniedHandler to process InvalidCsrfTokenException differently.

As of Spring Security 4.0, CSRF protection is enabled by default with XML configuration. If you would like to disable CSRF protection, the corresponding XML configuration can be seen below.

<http>
    <!-- ... -->
    <csrf disabled="true"/>
</http>

CSRF protection is enabled by default with Java Configuration. If you would like to disable CSRF, the corresponding Java configuration can be seen below. Refer to the Javadoc of csrf() for additional customizations in how CSRF protection is configured.

@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
    .csrf().disable();
}
}

I have done the java configuration but still its asking for csrf token in post request — Amit Das, Dec 09 '21 at 15:14

score 0 · Answer 2 · answered Jul 27 '23 at 19:40

By default, CSRF protection is enabled. However, you can disable CSRF protection if it makes sense for your application.

The Java configuration below will disable CSRF protection.

@Bean
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
    http
        // ...
        .csrf(csrf -> csrf.disable()))
    return http.build();
}

Reference

spring-cloud: Disable CSRF

2 Answers2