Spring Security - CSRF token on GET request

Question

I configured CSRF protection in my Spring 5 (Boot 2) RESTful web service because I want to prevent CSRF attacks (I am using JWT cookie for authentication and authorization). On each request I am getting a new XSRF cookie. The value of that cookie I am sending back through the X-CSRF-TOKEN header.

I noticed that POST, PUT and DELETE methods require the value of this token (in the X-CSRF-TOKEN header) in order to work properly, but GET method works just fine without X-CSRF-TOKEN header.

Is this behavior intentional because GET method should not change state or I did something wrong?

identigral · Accepted Answer · 2019-07-29 03:24:58Z

4

CSRF token is intentionally excluded from GET to avoid token leakage to a 3rd party

answered Jul 29, 2019 at 3:24

identigral

3,98420 silver badges38 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Spring Security - CSRF token on GET request

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related