What is CSRF in Spring Security?

CSRF stands for:

Cross-Site Request Forgery

CSRF is a type of security attack where an attacker tricks an authenticated user into performing unwanted actions on a web application without the user's knowledge.

Spring Security provides built-in CSRF protection to prevent such malicious attacks.

In simple words, CSRF protection ensures that requests sent to the server are genuinely initiated by the authenticated user.

---

Why CSRF is Dangerous

Many web applications use session-based authentication.

When users log in:

• Browser stores session cookies automatically
• Cookies are sent with every request

Attackers can exploit this behavior by forcing users to send malicious requests unknowingly.

---

Real-Life CSRF Example

Suppose a user is logged into an online banking application.

Banking API:

POST /transfer-money

If attacker tricks the user into visiting a malicious website, hidden requests may automatically transfer money using the user's existing authenticated session.

---

How CSRF Attack Works

1. User logs into banking website
2. Browser stores session cookie
3. User visits malicious website
4. Malicious website sends hidden request
5. Browser automatically includes session cookie
6. Banking server processes request

---

CSRF Attack Example

Malicious HTML:

<form action="https://bank.com/transfer"
      method="POST">

    <input type="hidden"
           name="amount"
           value="10000">

    <input type="hidden"
           name="account"
           value="attacker123">

</form>

<script>
    document.forms[0].submit();
</script>

---

What Happens in This Attack?

• User is already logged into bank website
• Browser sends session cookie automatically
• Server thinks request is genuine
• Money transfer may occur without user consent

---

How Spring Security Prevents CSRF

Spring Security uses:

CSRF Tokens

A CSRF token is:

• Unique
• Random
• Generated by server
• Required for state-changing requests

---

CSRF Protection Flow

1. User opens web page
2. Server generates CSRF token
3. Token is sent to browser
4. Browser includes token in form submission
5. Server validates token
6. Request is processed if token is valid

---

CSRF Token Example

<input type="hidden"
       name="_csrf"
       value="f8a9c3d7e4...">

---

Why Attackers Cannot Generate CSRF Tokens

CSRF tokens are:

• Generated securely by server
• Stored in user session
• Unknown to external malicious websites

Therefore attackers cannot create valid CSRF tokens.

---

CSRF Protection Enabled by Default

Spring Security automatically enables CSRF protection for web applications.

This helps protect:

• HTML forms
• Session-based applications
• Traditional MVC applications

---

Spring Security Dependency

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

---

Default CSRF Behavior in Spring Security

By default:

• GET requests are allowed
• POST requests require CSRF token
• PUT requests require CSRF token
• DELETE requests require CSRF token

---

Why GET Requests Usually Do Not Need CSRF Protection

GET requests should:

• Only fetch data
• Not modify server state

Examples:

• View profile
• View products
• Search data

---

Requests That Need CSRF Protection

HTTP Method	Purpose	Needs CSRF Protection
GET	Read data	No
POST	Create data	Yes
PUT	Update data	Yes
DELETE	Delete data	Yes

---

CSRF Token in Thymeleaf Form

Spring Security automatically integrates CSRF tokens in Thymeleaf forms.

Example

<form th:action="@{/save}"
      method="post">

    <input type="text" name="name">

    <button type="submit">Save</button>

</form>

---

Spring automatically adds:

<input type="hidden"
       name="_csrf"
       value="generated-token">

---

Disable CSRF in Spring Security

CSRF protection can be disabled when necessary.

Example

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(
            HttpSecurity http) throws Exception {

        http
            .csrf(csrf -> csrf.disable());

        return http.build();
    }
}

---

When Should CSRF Be Disabled?

CSRF is commonly disabled in:

• REST APIs
• JWT authentication systems
• Stateless applications
• Mobile backend APIs

---

Why JWT APIs Usually Disable CSRF

JWT authentication uses:

• Authorization headers
• Stateless authentication
• No session cookies

Since browsers do not automatically send JWT headers, CSRF attacks become much harder.

---

CSRF vs JWT Authentication

Feature	Session Authentication	JWT Authentication
Uses Cookies	Yes	Usually No
CSRF Risk	High	Lower
CSRF Protection Needed	Yes	Usually Disabled

---

CSRF Token Repository

Spring Security stores CSRF tokens using repositories.

Common repository:

HttpSessionCsrfTokenRepository

---

Cookie-Based CSRF Token Example

http.csrf(csrf ->
    csrf.csrfTokenRepository(
        CookieCsrfTokenRepository.withHttpOnlyFalse()
    )
);

---

Advantages of CSRF Protection

• Prevents forged requests
• Protects authenticated users
• Improves web application security
• Protects banking and payment systems
• Built-in support in Spring Security

---

Disadvantages of CSRF Protection

• Additional token management
• Can complicate frontend integration
• Improper implementation may break forms

---

Real-Time Example in Banking Application

Banking application contains:

• Money transfer forms
• Bill payment forms
• Profile update forms

CSRF protection ensures:

• Only genuine user requests are processed
• Attackers cannot forge requests
• Session-based authentication remains secure

---

Difference Between CSRF and XSS

Feature	CSRF	XSS
Full Form	Cross-Site Request Forgery	Cross-Site Scripting
Main Goal	Force unwanted actions	Inject malicious scripts
Target	Authenticated users	Browser execution

---

Best Practices for CSRF Protection

• Keep CSRF enabled for web applications
• Disable CSRF only for stateless APIs
• Use HTTPS always
• Validate tokens properly
• Use SameSite cookies when possible
• Avoid state-changing GET requests

---

Common CSRF Exceptions

Exception	Description
InvalidCsrfTokenException	Invalid CSRF token
MissingCsrfTokenException	CSRF token missing

---

Common Interview Questions on CSRF

What is CSRF?

CSRF is a security attack where attackers force authenticated users to perform unwanted actions.

How does Spring Security prevent CSRF?

Spring Security uses CSRF tokens to validate genuine requests.

Why is CSRF protection enabled by default?

Because session-based applications are vulnerable to CSRF attacks.

Why is CSRF disabled in JWT authentication?

JWT uses stateless authentication and does not rely on session cookies.

What HTTP methods usually require CSRF protection?

POST, PUT, and DELETE requests.

---

Conclusion

CSRF is a serious security vulnerability in session-based web applications.

Spring Security provides built-in CSRF protection using secure CSRF tokens.

Proper CSRF protection helps prevent forged requests, unauthorized actions, and malicious attacks against authenticated users.

Understanding CSRF is essential for Spring Boot developers because secure web application development requires protection against modern security threats.