CSRF token expires during login

Question

I\'m working on Spring web application and I need to avoid problem with expire csrf token on login page, because if user is waiting too long and try to login only one way to res

Answer 1

You can also make your CSRF protection rely on cookies and NOT server side session state. Spring Security has full support for this.

CookieCsrfTokenRepository

You will only receive a timeout if your cookie expires. This scales well since it's basically stateless (from the server's perspective).

@EnableWebSecurity
public class WebSecurityConfig extends
        WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf()
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
    }
}

Andrew