configurable option for csrf

Evolveum · Nov 9, 2017 · cbdf8ad · cbdf8ad
1 parent 12297e7
commit cbdf8ad
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/boot/WebSecurityConfig.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/boot/WebSecurityConfig.java
@@ -49,6 +49,8 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
     @Autowired
     private AuthenticationProvider authenticationProvider;
 
+    @Value("${security.enable-csrf:true}")
+    private boolean csrfEnabled;
     @Value("${auth.logout.url}")
     private String authLogoutUrl;
 
@@ -118,6 +120,10 @@ protected void configure(HttpSecurity http) throws Exception {
         http.exceptionHandling()
                 .authenticationEntryPoint(wicketAuthenticationEntryPoint());
 
+        if (!csrfEnabled) {
+            http.csrf().disable();
+        }
+
         http.headers().disable();
     }