Spring Security - Third Edition

Configuring CSRF protection

The next step is to include Spring Security's CSRF protection within your application. Some frameworks handle invalid CSRF tokens by invaliding the user's session, but this causes its own problems. Instead, by default, Spring Security's CSRF protection will produce HTTP 403 access denied. This can be customized by configuring AccessDeniedHandler to process InvalidCsrfTokenException differently.

For passivity reasons, if you are using the XML configuration, CSRF protection must be explicitly enabled using the <csrf> element. Refer to the <csrf> element's documentation for additional customizations.

SEC-2347 is logged to ensure Spring Security 4.x's XML namespace configuration will enable CSRF protection by default ...