Exploit Protection

In Spring Security 5.8, the default CsrfTokenRequestHandler responsible for providing the CsrfToken to the application is CsrfTokenRequestAttributeHandler. The default setting for the field csrfRequestAttributeName is null, leading to the loading of the CSRF token on every request.

Examples of situations where reading the session should be deemed unnecessary include endpoints explicitly marked with permitAll(), such as static assets, static HTML pages, and single-page applications hosted under the same domain/server.

In Spring Security 6, csrfRequestAttributeName now defaults to _csrf. If you had configured the following solely for the purpose of transitioning to version 6.0, you can now safely remove it:

requestHandler.setCsrfRequestAttributeName("_csrf");

Now that we have explored how to define the CsrfToken, we will explore how to protect against CSRF attacks.

Protecting against CSRF attacks

In Spring Security 5.8, the default CsrfTokenRequestHandler...