Package org.springframework.security.config.web.server

Class ServerHttpSecurity.CsrfSpec

java.lang.Object

org.springframework.security.config.web.server.ServerHttpSecurity.CsrfSpec

Enclosing class:

ServerHttpSecurity

public final class ServerHttpSecurity.CsrfSpec
extends java.lang.Object

Configures CSRF Protection

Since:

5.0

See Also:

ServerHttpSecurity.csrf()

Method Summary

Modifier and Type	Method	Description
ServerHttpSecurity.CsrfSpec	accessDeniedHandler(org.springframework.security.web.server.authorization.ServerAccessDeniedHandler accessDeniedHandler)	Configures the ServerAccessDeniedHandler used when a CSRF token is invalid.
ServerHttpSecurity	and()	Allows method chaining to continue configuring the ServerHttpSecurity
protected void	configure(ServerHttpSecurity http)
ServerHttpSecurity.CsrfSpec	csrfTokenRepository(org.springframework.security.web.server.csrf.ServerCsrfTokenRepository csrfTokenRepository)	Configures the ServerCsrfTokenRepository used to persist the CSRF Token.
ServerHttpSecurity.CsrfSpec	csrfTokenRequestHandler(org.springframework.security.web.server.csrf.ServerCsrfTokenRequestHandler requestHandler)	Specifies a ServerCsrfTokenRequestHandler that is used to make the CsrfToken available as an exchange attribute.
ServerHttpSecurity	disable()	Disables CSRF Protection.
ServerHttpSecurity.CsrfSpec	requireCsrfProtectionMatcher(org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher requireCsrfProtectionMatcher)	Configures the ServerWebExchangeMatcher used to determine when CSRF protection is enabled.
ServerHttpSecurity.CsrfSpec	tokenFromMultipartDataEnabled(boolean enabled)	Deprecated. Use ServerCsrfTokenRequestAttributeHandler.setTokenFromMultipartDataEnabled(boolean) instead

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

accessDeniedHandler

public ServerHttpSecurity.CsrfSpec accessDeniedHandler(org.springframework.security.web.server.authorization.ServerAccessDeniedHandler accessDeniedHandler)

Configures the ServerAccessDeniedHandler used when a CSRF token is invalid. Default is to send an HttpStatus.FORBIDDEN.

Parameters:

accessDeniedHandler - the access denied handler.

Returns:

the ServerHttpSecurity.CsrfSpec for additional configuration

csrfTokenRepository

public ServerHttpSecurity.CsrfSpec csrfTokenRepository(org.springframework.security.web.server.csrf.ServerCsrfTokenRepository csrfTokenRepository)

Configures the ServerCsrfTokenRepository used to persist the CSRF Token. Default is WebSessionServerCsrfTokenRepository.

Parameters:

csrfTokenRepository - the repository to use

Returns:

the ServerHttpSecurity.CsrfSpec for additional configuration

requireCsrfProtectionMatcher

public ServerHttpSecurity.CsrfSpec requireCsrfProtectionMatcher(org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher requireCsrfProtectionMatcher)

Configures the ServerWebExchangeMatcher used to determine when CSRF protection is enabled. Default is PUT, POST, DELETE requests.

Parameters:

requireCsrfProtectionMatcher - the matcher to use

Returns:

the ServerHttpSecurity.CsrfSpec for additional configuration

tokenFromMultipartDataEnabled

@Deprecated
public ServerHttpSecurity.CsrfSpec tokenFromMultipartDataEnabled(boolean enabled)

Deprecated.

Use ServerCsrfTokenRequestAttributeHandler.setTokenFromMultipartDataEnabled(boolean) instead

Specifies if CsrfWebFilter should try to resolve the actual CSRF token from the body of multipart data requests.

Parameters:

enabled - true if should read from multipart form body, else false. Default is false

Returns:

the ServerHttpSecurity.CsrfSpec for additional configuration

csrfTokenRequestHandler

public ServerHttpSecurity.CsrfSpec csrfTokenRequestHandler(org.springframework.security.web.server.csrf.ServerCsrfTokenRequestHandler requestHandler)

Specifies a ServerCsrfTokenRequestHandler that is used to make the CsrfToken available as an exchange attribute.

Parameters:

requestHandler - the ServerCsrfTokenRequestHandler to use

Returns:

the ServerHttpSecurity.CsrfSpec for additional configuration

Since:

5.8

and

public ServerHttpSecurity and()

Allows method chaining to continue configuring the ServerHttpSecurity

Returns:

the ServerHttpSecurity to continue configuring

disable

public ServerHttpSecurity disable()

Disables CSRF Protection. Disabling CSRF Protection is only recommended when the application is never used within a browser.

Returns:

the ServerHttpSecurity to continue configuring

configure

protected void configure(ServerHttpSecurity http)