Loading published curriculum…

16 · Spring Security in depth / LESSON 80 OF 102

CSRF protection for browser applications

CSRF defenses prevent an attacker from abusing credentials a browser attaches automatically.

Before this lesson: Session login, logout, and cookie policy

Understand the topic

A browser can send a session cookie with a forged request even when the attacker cannot read the response. Require the framework’s CSRF token on unsafe methods for the chosen session flow. GET should not mutate state.

Cookie-carried JWTs can also need CSRF protection because browsers attach cookies automatically. A stateless bearer token supplied explicitly in Authorization has different exposure, but disabling CSRF requires an explicit credential-delivery model, not merely the presence of the word API.

EXAMPLE · JAVA

Security test assertion fragment

mockMvc.perform(post("/api/tasks")
 .with(user("learner"))
 .contentType("application/json")
 .content("{"title":"CSRF lab"}"))
 .andExpect(status().isForbidden());
// Repeat with .with(csrf()) and assert the intended success result.

What to expect

Use spring-security-test and MockMvc static imports in a test that loads the real security filters. The missing token is rejected before the write.

YOUR TURN

Put it into practice

  1. 01Test an authenticated unsafe request with no token, an invalid token, and a valid token.
  2. 02Check that retrieval endpoints do not mutate state.
  3. 03Verify: Only the intended token-bearing operation changes data under the session authentication model.

Pass a quiz or complete a lab to check today’s streak. Each lesson counts once per day, including when you review it later.

UNDER THE HOOD

Build the mental model

CSRF defenses prevent an attacker from abusing credentials a browser attaches automatically.

  1. 01A browser can send a session cookie with a forged request even when the attacker cannot read the response. Require the framework’s CSRF token on unsafe methods for the chosen session flow. GET should not mutate state.
  2. 02Cookie-carried JWTs can also need CSRF protection because browsers attach cookies automatically. A stateless bearer token supplied explicitly in Authorization has different exposure, but disabling CSRF requires an explicit credential-delivery model, not merely the presence of the word API.
  3. 03Trace the example: Use spring-security-test and MockMvc static imports in a test that loads the real security filters. The missing token is rejected before the write.

A mistake worth avoiding

Every authenticated POST returns 403 and someone disables CSRF globally.

DEBUGGING ROOM

Something broke. Where do you look?

Every authenticated POST returns 403 and someone disables CSRF globally.

Before revealing the diagnosis, write down your first investigation step.

CHECK YOUR UNDERSTANDING

Does using JWT in a cookie automatically remove CSRF risk?

Choose one answer

BUILD IT YOURSELF

Test an authenticated unsafe request with no token, an invalid token, and a valid token.

  1. 1.Test an authenticated unsafe request with no token, an invalid token, and a valid token.
  2. 2.Check that retrieval endpoints do not mutate state.
  3. 3.Reproduce this failure, then repair it: Every authenticated POST returns 403 and someone disables CSRF globally.

Acceptance checklist

Lab completion is your self-report. Knowledge checks do not certify project quality.

RETRIEVE IT FROM MEMORY

Does using JWT in a cookie automatically remove CSRF risk?

Revisit this lesson in three days after a successful check or lab.

Ready for the next step?

Only the intended token-bearing operation changes data under the session authentication model.

Reading is separate from passing a knowledge check or completing a lab.

Go deeper · official references