Disable CSRF using property `security.enable-csrf`

[EliuX]

Summary

I want to disable the CSRF security by setting to false the property security.enable-csrf in a active applicaton .properties file.

Actual Behavior

Based on the official documentation by default this security is enabled. To disable it you must specify it in org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter#configure(org.springframework.security.config.annotation.web.builders.HttpSecurity) with

http.csrf().disable();

or its equivalent in xml configuration.

Expected Behavior

The variable security.enable-csrf is acknowledged as one of the common properties by Spring Boot, yet setting it to false doesn't solve anything.

Configuration

In my application.yml I have this section

---
spring:
  profiles: dev

security.enable-csrf: false

But setting the profile to dev won't disable the CRSF Security

Version

I am using spring-security-config-4.2.2.RELEASE

Possible solution

I solved this issue easily by specifying in my implementation of WebSecurityConfigurerAdapter the following code:

@Order(FRONTEND_SECURITY_ORDER)
@EnableAspectJAutoProxy
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true)
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    public static final int FRONTEND_SECURITY_ORDER
            = SecurityProperties.ACCESS_OVERRIDE_ORDER + 3;

    @Value("${security.enable-csrf}")
    private boolean csrfEnabled;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        if (!csrfEnabled) {
            http.csrf().disable();
        }

        http
                .httpBasic()
                //..... etc
    }
}

This will disable the csrf security if the property security.enable-csrf is set to false. An equivalent approach could be solved.

[mbhave]

@EliuX what version of Spring Boot are you using? For 2.0, we have made several changes to how the security configuration can be customized by users. To turn off Spring Boot's default security configuration, you need to add your own WebSecurityConfigurerAdapter and disable csrf there.

[spring-projects-issues]

If you would like us to look at this issue, please provide the requested information. If the information is not provided within the next 7 days this issue will be closed.

[shenxiusi]

@mbhave

I use springboot v1.4.2.RELEASE and also met this problem. Set "security.enable-csrf: false" in applicaton .properties won't help.

After add my own WebSecurityConfigurerAdapter like @EliuX, I got exception
org.springframework.beans.factory.NoUniqueBeanDefinitionException: No qualifying bean of type 'org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter' available: expected single matching bean but found 2: webSecurityConfig,defaultWebSecurityConfigurer

Could you give a tip on that? Thanks for the help.

[wilkinsona]

@shenxiusi If you have a question of your own, please ask on Stack Overflow.

[membersound]

Same for me on spring-boot 1.5.9