I'm using Spring Security with a stateless web service. I'd like to use the CSRF features in Spring Security 3.2. Is that possible with a stateless web app?
This is the relevant Java Config, since I've had to disable CSRF for the time being.
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.sessionFixation().none().and()
.csrf().disable();
}