无法禁用csrf Spring启动

Question

I'm developing an android app and I'm using Spring as a REST backend.

Every time I try to make post request to the server I get a 403 response with this message "Expected CSRF token not found. Has your session expired?".

I tried to disable csrf in the application.properties and with my own WebSecurityConfigurerAdapter implementation but to no avail.

Did I miss something ?

Answer 1

Try this :

.invalidateHttpSession(true)
.and()
.exceptionHandling()
.authenticationEntryPoint(new Http403ForbiddenEntryPoint())
.and()
.csrf()//Disabled CSRF protection
.disable();

Add this on your logoutSuccessHandler(...)

Answer 2

There are different ways to disable CSRF in Spring boot , by default in spring boot is enable

1. By Java Configuration

@Override
protected void configure(HttpSecurity http) throws Exception {
   http.csrf().disable();
}

2. By Application.yml

 security.enable-csrf: false