Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Enable CSRF protection by default

Browse Source 
See gh-11758
This commit is contained in:
Madhura Bhave
2018-02-16 14:43:50 -08:00
parent 85f45adb9a
commit 4e61136948
3 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SecurityProperties.java
View File

@@ -75,8 +75,7 @@ public class SecurityProperties implements SecurityPrerequisite {
/**
* Enable Cross Site Request Forgery support.
*/
// Flip this when session creation is disabled by default
private boolean enableCsrf = false;
private boolean enableCsrf = true;
private Basic basic = new Basic();

8
spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/SecurityPropertiesTests.java
View File

@@ -122,4 +122,12 @@ public class SecurityPropertiesTests {
assertThat(this.security.getUser().getRole().toString()).isEqualTo("[ADMIN]");
}
@Test
public void testCSrf() {
assertThat(this.security.isEnableCsrf()).isEqualTo(true);
this.binder.bind(new MutablePropertyValues(
Collections.singletonMap("security.enable-csrf", false)));
assertThat(this.security.isEnableCsrf()).isEqualTo(false);
}
}