CRSF LazyCsrfTokenRepository如何工作？

Question

Java 8 - spring 4.3.x

While configuring spring security and enable csrf feature i came across two implementations of CsrfTokenRepository one is Lazy another is Cokkie based

I know CookieCsrfTokenRepository works using writing a csrf token into cookie and accepts a cookie value in header to verify the valid request

Can some one help me to understand how does LazyCsrfTokenRepository works ?

Answer 1

From the javadoc :

A CsrfTokenRepository that delays saving new CsrfToken until the attributes of the CsrfToken that were generated are accessed.

So why this? In earlier versions of Spring Security the HttpSessionCsrfTokenRepository was default. The drawback with this was that it always creates a token, triggering session creation, regardless of whether the token was used or not, which could be wasteful in some applications.

The LazyCsrfTokenRepository on the other hand only creates a wrapper, and creates the actual token only if getToken() is invoked (like when for example generating a form). This avoids unnecessary session creation.

A gotcha with LazyCsrfTokenRepository is that the actual token generation must still happen before HTTP response is committed , otherwise you get an exception. If you get problem with this, it is easiest to use (only) one of the other two implementations.