在spring-security中更改csrf令牌

Question

i am using csrf in spring security, like this

<http auto-config="false" >
    ...
    <csrf />
    ...
</http>

and put in every jsp page like this

<meta name="_csrf" content="${_csrf.token}" />
<meta name="_csrf_header" content="${_csrf.headerName}" />

The problem is that, every time I refresh the page, i want change the token. but as long as the user is logged in, the token does not change.

Answer 1

Spring default use per-session csrf, you could check here for its implementation. Per change token, I recommend you implement your own . And call its method to reset token when you need to.