如何在Spring Security中发送一些没有csrf令牌的jsp表单

Question

I am using <csrf/> tag in my spring security xml file for a web project. By this tag I have to send csrf token in each form used in the jsp page.

Spring security xml code:

    <http auto-config="false" use-expressions="true" disable-url-rewriting="true">

    <intercept-url pattern="/**" access="isAuthenticated()" />

    <form-login
    <!--login tags -->
    </>

    <csrf/>
    </http>

But there is a scenario where I don't want to send the csrf token for a particular form in a jsp page, How could I do that.

I used the following tag in my xml file

<http pattern="/specific_url/**">
  <csrf disabled="true"/>
</http>

and got error: " cvc-complex-type.3.2.2: Attribute 'disabled' is not allowed to appear in element 'csrf' "

Answer 1

For Spring Security version 3.2.x, the CSRF protection is disabled by default when using XML configuration. So just remove the csrf element from the config, and it will be off.

From version 4, CSRF protection is enabled by default, so if you upgrade you will need the snippet suggested in question.