Search code examples
javaspringmodel-view-controllercsrf

How to prevent CSRF attack in Spring mvc 4

I have java spring mvc project. I wanted to know how to protect my webApp from CSRF .I have read , Spring handles that default, does that mean I don't have to config anything and I am still safe? Thanks in advance.

Solution

  • If you are using Spring Security then CSRF protection is enabled by default since version 4.0.

    Have a look to the documentation to be sure what you need to do:

    Spring Security CSRF protection

    It says, basically, you need to be sure your app use proper HTTP verbs: PATCH, POST, PUT, and/or DELETE for anything that modifies state and POST instead of GET when sending back sensitive information.

    Then, as the CSRF protection is enabled by default using Spring Security, then you only need to include the CSRF Token when sending your payload (forms, json, etc.)