How to handle CSRF protection with Spring RESTful web services?

11
votes

I have a Spring web application with CSRF protection enabled. I am able to access the RESTful service via AJAX calls, but when I am accessing the service with other applications like httpurlconnection, I get a 401 error (CSRF token null).

I understand that to access the RESTful service I need to pass a token in the request header, but how can I get the CSRF token?

1
springrestspring-mvcspring-securitycsrf

1 Answers

24
votes

You can create a mapping in Spring MVC that gets the CSRF token:

@RequestMapping(value="/csrf-token", method=RequestMethod.GET)
public @ResponseBody String getCsrfToken(HttpServletRequest request) {
    CsrfToken token = (CsrfToken)request.getAttribute(CsrfToken.class.getName());
    return token.getToken();
}