Search code examples
springcsrf

Spring Web Security Config - Ignore CSRF Validation for either or

I have certain conditions to ignore csrf validations but I am not sure how to put this in config. Following are my conditions to ignore the validation:

  • Has a Bearer token in the authorization.

Or

  • Particular URL

Here is the config I have now:

security.csrf().ignoringRequestMatchers(new RequestHeaderRequestMatcher("Authorization")).ignoringAntMatchers("/test").and();

But with this config, I guess it is treating it like an AND operation or something. How can I change this?

Solution

  • Try the OrRequestMatcher.

    security.csrf()
       .ignoringRequestMatchers(new OrRequestMatcher(new RequestHeaderRequestMatcher("Authorization"), new AntPathRequestMatcher("/test")));