advanced~2h
CSRF: Cross-Site Request Forgery
CSRF protection is on by default in Spring Security for a specific reason tied to cookies — and disabling it globally to "fix" a 403 is one of the most common security regressions teams introduce.
Learning objectives
- Beginner: Explain why CSRF specifically targets cookie-based session authentication, not token-based auth.
- Intermediate: Wire up CSRF token handling correctly for an Angular/SPA client.
- Advanced: Justify disabling CSRF only for specific stateless endpoints, rather than globally for the whole application.
This is a Pro chapter
Sign in, then upgrade to Pro or Power to unlock this and the full Spring Ecosystem Mastery library.
CSRF: Cross-Site Request Forgery