Menu

How to enable CSRF protection in a Spring?

How to enable CSRF protection in a Spring?

CSRF is a security vulnerability where an attacker tricks a user into unknowingly submitting a request to a web application where they are authenticated. This can lead to unauthorized actions being performed on behalf of the user.

Protection

To prevent CSRF attacks, web applications can use CSRF tokens. These tokens are included in requests to verify that the request originated from a trusted source.

Enabling CSRF Protection in Spring MVC

In Spring MVC, CSRF protection can be enabled through the `Spring Security` configuration. By default, Spring Security includes CSRF protection, but it needs to be properly configured to ensure it is active and used in forms and AJAX requests.

Usage:

CSRF protection is enabled in Spring Security’s configuration. The framework uses a token mechanism to ensure that requests are valid and come from authorized users.

CSRF protection

Example

1. Spring Security Configuration

To enable CSRF protection, you need to configure Spring Security in your application. Here’s how you can do it using Java-based configuration:

Example
SecurityConfig.java
```java
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.csrf.CsrfFilter;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/public/").permitAll()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
            .logout()
                .permitAll()
                .and()
            .csrf(); // Enable CSRF protection
    }
}
```

In this example:

  • csrf(): This method call enables CSRF protection in Spring Security. It ensures that a CSRF token is required for all state-changing requests (e.g., POST, PUT, DELETE).

2. Using CSRF Tokens in Forms

When using CSRF protection, you need to include the CSRF token in forms. This can be done using Spring’s tag library.

Example
login.jsp
```jsp
<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>
<html>
<head>
    <title>Login</title>
</head>
<body>
    <form action="/login" method="post">
        <sec:csrfInput />
        <label for="username">Username:</label>
        <input type="text" id="username" name="username"/>
        <label for="password">Password:</label>
        <input type="password" id="password" name="password"/>
        <button type="submit">Login</button>
    </form>
</body>
</html>
```

In this example:

  • <sec:csrfInput />: This tag generates an input field containing the CSRF token. It ensures that the token is included in the form submission.

3. Handling CSRF in AJAX Requests

    For AJAX requests, you need to include the CSRF token in the request headers.

    Handling CSRF in AJAX Requests
    

Example JavaScript (Using jQuery)
```javascript
$(document).ready(function() {
    var csrfToken = $('meta[name="_csrf"]').attr('content');
    var csrfHeader = $('meta[name="_csrf_header"]').attr('content');

    $.ajaxSetup({
        beforeSend: function(xhr) {
            xhr.setRequestHeader(csrfHeader, csrfToken);
        }
    });
});
```

    In this example:

    • $.ajaxSetup: Configures jQuery to include the CSRF token in the headers of all AJAX requests.

    Summary

    • CSRF Protection: Prevents unauthorized actions on behalf of authenticated users.
    • Enabling CSRF: Achieved by configuring Spring Security (csrf() method).
    • Forms: Include CSRF token using <sec:csrfInput /> in JSP forms.
    • AJAX Requests: Include CSRF token in headers using JavaScript.

    Homepage

    Readmore