Geek asks and answers

Rename CSRF Header Header Using Spring Security

I refer to the following Spring csrf configuration security documentation .

It seems the default header name for the csrf token is: X-CSRF-TOKEN

As described in the documentation:

<meta name="_csrf" content="${_csrf.token}"/>
<!-- default header name is X-CSRF-TOKEN -->
<meta name="_csrf_header" content="${_csrf.headerName}"/>

AngularJs seems to use the following header name: X-XSRF-TOKEN

  • How to change header name on spring security side?
  • Is this the best way to continue?
  • Will this affect CSRF protection on a classic form other than ajax, and in particular, the name of the XSRF parameter?
+3
source share
1 answer

bean HttpSessionCsrfTokenRepository, headerName CSRF <security:csrf token-repository-ref="..." />. ,

<bean id="csrfTokenRepository" class="org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository">
    <property name="headerName" value="X-SECURITY" />
</bean>

<security:http>
    <security:csrf token-repository-ref="csrfTokenRepository" />
</security:http>
+4

More articles:


All Articles