Spring Security - Third Edition

Logging in

In order to protect against forged login requests, the login form should be protected against CSRF attacks, too. Since the CsrfToken token is stored in HttpSession, this means an HttpSession mehthod will be created as soon as the CsrfToken attribute is accessed. While this sounds bad in a RESTful/stateless architecture, the reality is that the state is necessary to implement practical security. Without the state, we have nothing we can do if a token is compromised. Practically speaking, the CSRF token is quite small in size and should have a negligible impact on our architecture.

An attacker may forge a request to log the victim into a target website using the attacker's credentials; this is known as login CSRF (https://en.wikipedia.org/wiki/Cross-site_request_forgery#Forging_login_requests ...