The CSRF Protection with Spring Security | Spring Boot Backend #3.5

In this video I will explain the CSRF attack, the Cross-Site Request Forgery attack. I will show how Spring Security can protect against this attack, in both a server side rendering server and with a separated frontend and the Cookie repository.

Content:
* What is the CSRF attack, the Cross-Site Request Forgery attack;
* What are the typical mistakes made with this attack;
* How to allow multiple origins to request my backend;
* How to enable the CSRF protection in Spring Security correctly.

Icons:

[venera]

Thank you so much for this! You explained in 8 minutes what people couldn't explain in a 1 hour video.

[SuperYkf]

Hi Sergio. This is a great video. Thanks. I also want to know at what point you call the CsrfController endpoint from React. Do you have a video that shows this?

[whoatulverma]

Can you show me where in your react frontend you have implemented sending "X-XSRF-TOKEN" header ?

[rauliciii]

Hi,
Should this work in Postman? I'm getting 403 for very request, even tho I hit the /csrf endpoint before each request. (Using SpringBoot 3.2.1)

[yassirbenyahia]

Thanks you for the video, you are the best

[alimrad]

if my spring boot application, accept request from frontend web application and mobile application, is this configuration affect the mobile side ?

[rauliciii]

Hi,
I see a fall in this approach. If the Bad Site uses (lets say) a JavaScript Block and calls the /csrf API before calling the /deleeteAllData API (making 2 requests one after the another). The first request would ensure you have a Token ready (or overriding your existing token from cookie). That would ensure the success of the second request.
Am I missing something?

[konstantindevelops]

Thanks you for the amazing video. Can we have the repo with the frontend because I am interested in how you handle the csrf/cors there too? Much love from Bulgaria! <3

[yoyo-]

great but one thing that is not clear:your front end in React should call the CSRF controller when it start up ? Or when the user login ?

[ProjectAryawarta]

is the /v1/csrf controller needs to be called on launch of the UI?

[christianrojas]

Great job, very helpful! Youre the 'Macho'

[christianrojas]

Hola, tengo una duda, el cookie y el header están devolviendo tokens diferentes, tienes alguna idea de por qué? Gracias

[vh]

It looks like you had mixed spring security 6 and 5-. Do I right? I try to found solution for spring security 6 a lot of time and can't

[vivekkamineni]

how to check whether the csrf token is valid if our code is running on multiple servers

[sharrmilaadevi]

Thank you so much for the video. I tried the same without controller csrf itself, spring is validating the csrf token from header& cookie for login and same is not working for logout, even if I change to post method and I am not sending the csrf token to frontend..

[syedtahauddin]

Can you let me know how to enable csrf token in spring cloud gateway application??
Thanks in advance

[matiascolilcolil]

es normal que el valor del token y el valor de la cookie sea distinto?

[TechFrame-krfv]

With your config I'm always getting the same csrf token back!
Edit: It does not refresh when I use that token to authorize / get an jwt token, but it refreshes on all other post requests.

[rodolfohill]

Podrias mostrar el codigo del login page. Lo que entiendo es que utilizas useEffect para llamar el servicio de generacion del token _csrf. Eso actualizar el _csrf del header. Y tienes un campo en tu forma con el _csrf. Si el _csrf header es diferente al capturado ... hubo modificacion por parte del usuario.

[adhdaddventure]

Any good way to write JUnit test for it?