Spring Security - Third Edition

Default CSRF token support

If you are using the Spring MVC <form:form> tag, or Thymeleaf 2.1+, and you replace @EnableWebSecurity with @EnableWebMvcSecurity, the CsrfToken token is automatically included for you (using the  CsrfRequestDataValue token we have been processing).

So, for this book, we have been using Thymeleaf for all of our web pages. Thymeleaf has CSRF support enabled by default if we enable CSRF support in Spring Security.

You should start with the code from chapter16.01-calendar.

If we start up the JBCP calendar application and navigate to the login page at https://localhost:8443/login.html, we can view the generated source for the login.html page, as follows:

    <form method="POST" action="/login" ...>      ... <input type="hidden" ...