Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Revisit CSRF page

Browse Source 
Closes gh-13089
This commit is contained in:
Steve Riesenberg
2023-05-02 16:08:37 -05:00
parent 97a42ba190
commit e7fa34008b
10 changed files with 1237 additions and 213 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/modules/ROOT/pages/servlet/integrations/mvc.adoc
View File

@@ -534,7 +534,7 @@ Spring Security integrates with Spring MVC to add CSRF protection.
=== Automatic Token Inclusion
Spring Security automatically xref:servlet/exploits/csrf.adoc#servlet-csrf-include[include the CSRF Token] within forms that use the https://docs.spring.io/spring/docs/3.2.x/spring-framework-reference/html/view.html#view-jsp-formtaglib-formtag[Spring MVC form tag].
Spring Security automatically xref:servlet/exploits/csrf.adoc#csrf-integration-form[include the CSRF Token] within forms that use the https://docs.spring.io/spring/docs/3.2.x/spring-framework-reference/html/view.html#view-jsp-formtaglib-formtag[Spring MVC form tag].
Consider the following JSP:
====

2
docs/modules/ROOT/pages/servlet/integrations/websocket.adoc
View File

@@ -281,7 +281,7 @@ Typically we need to include the CSRF token in an HTTP header or an HTTP paramet
However, SockJS does not allow for these options.
Instead, we must include the token in the Stomp headers.
Applications can xref:servlet/exploits/csrf.adoc#servlet-csrf-include[obtain a CSRF token] by accessing the request attribute named `_csrf`.
Applications can xref:servlet/exploits/csrf.adoc#csrf-integration[obtain a CSRF token] by accessing the request attribute named `_csrf`.
For example, the following allows accessing the `CsrfToken` in a JSP:
====