What is the reason to disable csrf in spring boot web application?

user_9851955 0
Viewed 30411

There are many tutorials where is shown how to disable csrf, 

csrf().disable()

(and other possibilities like .properties, .yml, etc.) but nowhere explained why they do this?

So my questions are:

What is the real-life reason to disable it?
Is it improves performance?

spring-boot csrf spring-security spring java
3 Answers

What is the real-life reason to disable it?

The Spring documentation suggests:

Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-browser clients, you will likely want to disable CSRF protection.

Does it improve performance?

It shouldn't impact the performance. A filter (or another component) will be removed from the request processing chain to make the feature unavailable.

What is the reason to disable csrf in a Spring Boot application?

  1. You are using another token mechanism.
  2. You want to simplify interactions between a client and the server.
user_49223750

Spring recommend using it when serving browser clients, if not it may be disabled:

Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-browser clients, you will likely want to disable CSRF protection.

I will add that even if you serve browser clients, but it's used internally only you may want/able to remove it.

user_72949000

Yes, it is safe to disable if you have a different authentication mechanism that cannot be cloaked. For internal enterprise applications, not much of a concern. We had to disable it because it was interfering with our existing authentication mechanism.

user_1565220
Related