How to use Spring Security's CSRF feature for stateless endpoints?

Viewed 2892

I'm using Spring Security with a stateless web service. I'd like to use the CSRF features in Spring Security 3.2. Is that possible with a stateless web app?

This is the relevant Java Config, since I've had to disable CSRF for the time being.

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .sessionFixation().none().and()
            .csrf().disable();
}
2 Answers
Related