There are many tutorials where is shown how to disable csrf,
csrf().disable()
(and other possibilities like .properties, .y
Spring recommend to use it when serving browser clients, if not it may be disabled:
Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-browser clients, you will likely want to disable CSRF protection.
I will add that even if you server browsers clients, but it's use internally only you may want/able to remove it.