Spring Security - Third Edition

CSRF and stateless browser applications

What if your application is stateless? That doesn't necessarily mean you are protected. In fact, if a user does not need to perform any actions in the web browser for a given request, they are likely still vulnerable to CSRF attacks.

For example, consider an application using a custom cookie that contains all of the states within it for authentication instead of the JSESSIONID cookie. When the CSRF attack happens, the custom cookie will be sent with the request in the same manner that the JSESSIONID cookie was sent in our previous example.

Users using basic authentication are also vulnerable to CSRF attacks, since the browser will automatically include the username and password in any requests, in the ...