I have a rest api where I have exposed get, post, put and delete methods. I am using spring security and implementing basic authentication. I am allowing the GET request to be made by a user with the role USER whereas the other requests can only be made by a user with role ADMIN. I see that if I don't add the crsf().disable() line only the GET method works correctly, whereas I get a 403 Forbidden for other methods. However when I add csrf().disable() all the methods work fine. Is this expected or am I doing something wrong?
Spring security - CSRF with REST methods
Admin
1
Viewed 842
1 Answers
When csrf is enabled , springboot expects you to send the csrf token with every request that is made to the endpoint. If that is not included then the request is denied and you get the 403 response code. It is like an HTTP session. But rest endpoints are stateless so it's better not to use csrf with it . Rest endpoints are essentially immune to csrf attacks as they are stateless.Read doc.
Related