Configuring CSRF Protection

Spring Security 6 provides built-in support for protecting against Cross-Site Request Forgery (CSRF) attacks. When using Spring Security in combination with Angular, it’s important to configure CSRF protection to ensure that your application is secure.

Configuring Spring Security

To configure CSRF protection in Spring Security, you can use the csrf() method in your security configuration. For example:

  
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .csrf()
                  .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
      }
  }
  

In this example, we use the CookieCsrfTokenRepository with the withHttpOnlyFalse() method to customize the CSRF protection to our requirements.

Configuring Angular

When working with Angular, you’ll need to configure your application to send CSRF tokens with each request. You can do this by retrieving the CSRF token from a secure cookie and attaching it to your HTTP requests.

Here’s an example of how you can configure Angular to send CSRF tokens:

  
  import { HttpClient, HttpHeaders } from '@angular/common/http';
  
  export class MyService {
  
      constructor(private http: HttpClient) { }
      
      public sendRequest(data: any) {
          const csrfToken = this.getCSRFToken();
          const headers = new HttpHeaders()
              .set('X-XSRF-TOKEN', csrfToken);
          
          this.http.post('http://example.com/api', data, { headers })
              .subscribe(response => {
                  // Handle response
              });
      }
      
      private getCSRFToken(): string {
          const cookieValue = document.cookie
              .split('; ')
              .find(cookie => cookie.startsWith('XSRF-TOKEN='));
          
          return cookieValue ? cookieValue.split('=')[1] : '';
      }
  }
  

Conclusion

By configuring CSRF protection in Spring Security and Angular, you can ensure that your application is protected against CSRF attacks. This is an important aspect of securing your web application and should always be considered when building web applications with Spring Security and Angular.