org.springframework.security.config.annotation.web.configurers

Class CsrfConfigurer<H extends HttpSecurityBuilder<H>>

java.lang.Object

org.springframework.security.config.annotation.SecurityConfigurerAdapter<DefaultSecurityFilterChain,B>

org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer<CsrfConfigurer<H>,H>

org.springframework.security.config.annotation.web.configurers.CsrfConfigurer<H>

All Implemented Interfaces:

SecurityConfigurer<DefaultSecurityFilterChain,H>

public final class CsrfConfigurer<H extends HttpSecurityBuilder<H>>
extends AbstractHttpConfigurer<CsrfConfigurer<H>,H>

Adds CSRF protection for the methods as specified by requireCsrfProtectionMatcher(RequestMatcher).

Security Filters

The following Filters are populated

• CsrfFilter

Shared Objects Created

No shared objects are created.

Shared Objects Used

• ExceptionHandlingConfigurer.accessDeniedHandler(AccessDeniedHandler) is used to determine how to handle CSRF attempts
• InvalidSessionStrategy

Since:

3.2

Constructor Summary

Constructors

Constructor and Description
CsrfConfigurer(ApplicationContext context) Creates a new instance

Method Summary

Modifier and Type	Method and Description
void	configure(H http) Configure the SecurityBuilder by setting the necessary properties on the SecurityBuilder.
CsrfConfigurer<H>	csrfTokenRepository(CsrfTokenRepository csrfTokenRepository) Specify the CsrfTokenRepository to use.
CsrfConfigurer<H>	ignoringAntMatchers(String... antPatterns) Allows specifying HttpServletRequest that should not use CSRF Protection even if they match the requireCsrfProtectionMatcher(RequestMatcher).
CsrfConfigurer<H>	requireCsrfProtectionMatcher(RequestMatcher requireCsrfProtectionMatcher) Specify the RequestMatcher to use for determining when CSRF should be applied.

Methods inherited from class org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer

disable, withObjectPostProcessor

Methods inherited from class org.springframework.security.config.annotation.SecurityConfigurerAdapter

addObjectPostProcessor, and, getBuilder, init, postProcess, setBuilder

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

CsrfConfigurer

public CsrfConfigurer(ApplicationContext context)

Creates a new instance

See Also:

HttpSecurity.csrf()

Method Detail

csrfTokenRepository

public CsrfConfigurer<H> csrfTokenRepository(CsrfTokenRepository csrfTokenRepository)

Specify the CsrfTokenRepository to use. The default is an HttpSessionCsrfTokenRepository wrapped by LazyCsrfTokenRepository.

Parameters:

csrfTokenRepository - the CsrfTokenRepository to use

Returns:

the CsrfConfigurer for further customizations

requireCsrfProtectionMatcher

public CsrfConfigurer<H> requireCsrfProtectionMatcher(RequestMatcher requireCsrfProtectionMatcher)

Specify the RequestMatcher to use for determining when CSRF should be applied. The default is to ignore GET, HEAD, TRACE, OPTIONS and process all other requests.

Parameters:

requireCsrfProtectionMatcher - the RequestMatcher to use

Returns:

the CsrfConfigurer for further customizations

ignoringAntMatchers

public CsrfConfigurer<H> ignoringAntMatchers(String... antPatterns)

Allows specifying HttpServletRequest that should not use CSRF Protection even if they match the requireCsrfProtectionMatcher(RequestMatcher).

The following will ensure CSRF protection ignores:

• Any GET, HEAD, TRACE, OPTIONS (this is the default)
• We also explicitly state to ignore any request that starts with "/sockjs/"

 http
     .csrf()
         .ignoringAntMatchers("/sockjs/**")
         .and()
     ...
 

Since:

4.0

configure

public void configure(H http)
               throws Exception

Description copied from interface: SecurityConfigurer

Configure the SecurityBuilder by setting the necessary properties on the SecurityBuilder.

Specified by:

configure in interface SecurityConfigurer<DefaultSecurityFilterChain,H extends HttpSecurityBuilder<H>>

Overrides:

configure in class SecurityConfigurerAdapter<DefaultSecurityFilterChain,H extends HttpSecurityBuilder<H>>

Throws:

Exception