Skip to content

Spring 中文文档社区
Spring 中文文档社区

leuher / Spring 中文文档社区
与 Fork 源项目一致

Fork自 开发云 / Spring 中文文档社区

通知 1
Star 0
Fork 0
Spring 中文文档社区
Spring 中文文档社区

前往新版Gitcode，体验更适合开发者的 AI 搜索 >>

切换分支/标签
查找文件 普通视图历史永久链接Permalink
features-exploits-csrf.html 111.0 KB
Newer Older
茶陵後's avatar
#1 静态文件复制  
茶陵後 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 
<!DOCTYPE html>
<html lang="en-US">
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width,initial-scale=1">
    <title>Cross Site Request Forgery (CSRF) | Spring Docs</title>
    <meta name="generator" content="VuePress 1.9.7">
    <link rel="icon" type="image/png" sizes="16x16" href="/images/icons/favicon.ico">
    <link rel="icon" type="image/png" sizes="48x48" href="/images/icons/icon-48x48.png">
    <link rel="icon" type="image/png" sizes="72x72" href="/images/icons/icon-72x72.png">
    <link rel="manifest" href="/manifest.webmanifest">
    <link rel="apple-touch-icon" href="/images/icons/icon_48x48.png">
    <link rel="mask-icon" href="/images/icons/favicon.ico" color="#5dac38">
    <script>
    var _hmt = _hmt || [];
    (function () {
      var hm = document.createElement("script");
      hm.src = "https://hm.baidu.com/hm.js?8eefd6b163dcb3f5762af6b0825e2dd1";
      var s = document.getElementsByTagName("script")[0];
      s.parentNode.insertBefore(hm, s);
    })();
    </script>
    <meta name="description" content="Spring provides comprehensive support for protecting against Cross Site Request Forgery (CSRF) attacks.
In the following sections we will explore:">
    <meta name="twitter:title" content="Cross Site Request Forgery (CSRF)">
    <meta name="twitter:description" content="Spring provides comprehensive support for protecting against Cross Site Request Forgery (CSRF) attacks.
In the following sections we will explore:">
    <meta name="twitter:card" content="summary">
    <meta name="twitter:url" content="https://spring.gitcode.net/en/spring-security/features-exploits-csrf.html">
    <meta property="og:type" content="article">
    <meta property="og:title" content="Cross Site Request Forgery (CSRF)">
    <meta property="og:description" content="Spring provides comprehensive support for protecting against Cross Site Request Forgery (CSRF) attacks.
In the following sections we will explore:">
    <meta property="og:url" content="https://spring.gitcode.net/en/spring-security/features-exploits-csrf.html">
    <meta property="og:site_name" content="Spring 中文文档社区">
    <meta itemprop="name" content="Cross Site Request Forgery (CSRF)">
    <meta itemprop="description" content="Spring provides comprehensive support for protecting against Cross Site Request Forgery (CSRF) attacks.
In the following sections we will explore:">
    <meta name="application-name" content="Spring 中文文档社区">
    <meta name="apple-mobile-web-app-title" content="Spring 中文社区">
    <meta name="apple-mobile-web-app-status-bar-style" content="black">
    <meta name="msapplication-TileColor" content="#5dac38">
    <meta name="theme-color" content="#5dac38">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="baidu-site-verification" content="code-tApgxyb9G8">
    
    <link rel="preload" href="/assets/css/0.styles.28585500.css" as="style"><link rel="preload" href="/assets/js/app.91a38a71.js" as="script"><link rel="preload" href="/assets/js/3.50918073.js" as="script"><link rel="preload" href="/assets/js/4.cd4c3ff4.js" as="script"><link rel="preload" href="/assets/js/168.e16111b9.js" as="script"><link rel="prefetch" href="/assets/js/10.675f4d7e.js"><link rel="prefetch" href="/assets/js/100.89ddf0f9.js"><link rel="prefetch" href="/assets/js/101.a2584c55.js"><link rel="prefetch" href="/assets/js/102.53225958.js"><link rel="prefetch" href="/assets/js/103.be06048d.js"><link rel="prefetch" href="/assets/js/104.a2328e06.js"><link rel="prefetch" href="/assets/js/105.75f4c207.js"><link rel="prefetch" href="/assets/js/106.fc779386.js"><link rel="prefetch" href="/assets/js/107.048638f4.js"><link rel="prefetch" href="/assets/js/108.18ecb5f7.js"><link rel="prefetch" href="/assets/js/109.22b51609.js"><link rel="prefetch" href="/assets/js/11.b58e279a.js"><link rel="prefetch" href="/assets/js/110.0e5bfcfe.js"><link rel="prefetch" href="/assets/js/111.62ba447b.js"><link rel="prefetch" href="/assets/js/112.3809d092.js"><link rel="prefetch" href="/assets/js/113.edbb458c.js"><link rel="prefetch" href="/assets/js/114.7e2b354f.js"><link rel="prefetch" href="/assets/js/115.4e41285c.js"><link rel="prefetch" href="/assets/js/116.faaa2083.js"><link rel="prefetch" href="/assets/js/117.4952cce2.js"><link rel="prefetch" href="/assets/js/118.306eabfa.js"><link rel="prefetch" href="/assets/js/119.7906e435.js"><link rel="prefetch" href="/assets/js/12.80bb4902.js"><link rel="prefetch" href="/assets/js/120.496c9660.js"><link rel="prefetch" href="/assets/js/121.e4a22135.js"><link rel="prefetch" href="/assets/js/122.06face15.js"><link rel="prefetch" href="/assets/js/123.190f461f.js"><link rel="prefetch" href="/assets/js/124.11d8be3e.js"><link rel="prefetch" href="/assets/js/125.d2296472.js"><link rel="prefetch" href="/assets/js/126.9cb2911c.js"><link rel="prefetch" href="/assets/js/127.870cadbf.js"><link rel="prefetch" href="/assets/js/128.456206df.js"><link rel="prefetch" href="/assets/js/129.ce51dc7d.js"><link rel="prefetch" href="/assets/js/13.29c1dc4b.js"><link rel="prefetch" href="/assets/js/130.89081f08.js"><link rel="prefetch" href="/assets/js/131.713226b7.js"><link rel="prefetch" href="/assets/js/132.6e2b68e3.js"><link rel="prefetch" href="/assets/js/133.2169bc8f.js"><link rel="prefetch" href="/assets/js/134.8de25763.js"><link rel="prefetch" href="/assets/js/135.961f6693.js"><link rel="prefetch" href="/assets/js/136.67bf4a6c.js"><link rel="prefetch" href="/assets/js/137.331bfb6b.js"><link rel="prefetch" href="/assets/js/138.f76ee7b9.js"><link rel="prefetch" href="/assets/js/139.578aa70e.js"><link rel="prefetch" href="/assets/js/14.1c437f54.js"><link rel="prefetch" href="/assets/js/140.9f1f28a0.js"><link rel="prefetch" href="/assets/js/141.b08ac1ec.js"><link rel="prefetch" href="/assets/js/142.e5c934cf.js"><link rel="prefetch" href="/assets/js/143.fdf42ebd.js"><link rel="prefetch" href="/assets/js/144.ad496c5f.js"><link rel="prefetch" href="/assets/js/145.5cf8f99c.js"><link rel="prefetch" href="/assets/js/146.979b34c1.js"><link rel="prefetch" href="/assets/js/147.46e366af.js"><link rel="prefetch" href="/assets/js/148.efcd2b17.js"><link rel="prefetch" href="/assets/js/149.52fc1f3e.js"><link rel="prefetch" href="/assets/js/15.cbd21f6a.js"><link rel="prefetch" href="/assets/js/150.679d76bf.js"><link rel="prefetch" href="/assets/js/151.2b0748da.js"><link rel="prefetch" href="/assets/js/152.2a21e665.js"><link rel="prefetch" href="/assets/js/153.571ff4a7.js"><link rel="prefetch" href="/assets/js/154.d89cac86.js"><link rel="prefetch" href="/assets/js/155.35a3e5ab.js"><link rel="prefetch" href="/assets/js/156.27654cff.js"><link rel="prefetch" href="/assets/js/157.036f4ba2.js"><link rel="prefetch" href="/assets/js/158.3767bc38.js"><link rel="prefetch" href="/assets/js/159.3fc08b95.js"><link rel="prefetch" href="/assets/js/16.0cc4679e.js"><link rel="prefetch" href="/assets/js/160.9c73e6f0.js"><link rel="prefetch" href="/assets/js/161.5707040f.js"><link rel="prefetch" href="/assets/js/162.f7bd796e.js"><link rel="prefetch" href="/assets/js/163.c7fd0b0f.js"><link rel="prefetch" href="/assets/js/164.117eb7b8.js"><link rel="prefetch" href="/assets/js/165.4fabe2ea.js"><link rel="prefetch" href="/assets/js/166.0e4c049b.js"><link rel="prefetch" href="/assets/js/167.c8a74627.js"><link rel="prefetch" href="/assets/js/169.34048f7e.js"><link rel="prefetch" href="/assets/js/17.d3f5977b.js"><link rel="prefetch" href="/assets/js/170.4b38adcf.js"><link rel="prefetch" href="/assets/js/171.e57611aa.js"><link rel="prefetch" href="/assets/js/172.9ca2eb1a.js"><link rel="prefetch" href="/assets/js/173.0b5757a5.js"><link rel="prefetch" href="/assets/js/174.88d987b1.js"><link rel="prefetch" href="/assets/js/175.5989a4ca.js"><link rel="prefetch" href="/assets/js/176.ec96435a.js"><link rel="prefetch" href="/assets/js/177.ccf0210e.js"><link rel="prefetch" href="/assets/js/178.f1f78ad5.js"><link rel="prefetch" href="/assets/js/179.a1faadfe.js"><link rel="prefetch" href="/assets/js/18.1a2bbade.js"><link rel="prefetch" href="/assets/js/180.06a789e3.js"><link rel="prefetch" href="/assets/js/181.ed535589.js"><link rel="prefetch" href="/assets/js/182.2ea92f58.js"><link rel="prefetch" href="/assets/js/183.ae7d9259.js"><link rel="prefetch" href="/assets/js/184.8a38d25a.js"><link rel="prefetch" href="/assets/js/185.567bf0f2.js"><link rel="prefetch" href="/assets/js/186.cc535cf2.js"><link rel="prefetch" href="/assets/js/187.cf4186a5.js"><link rel="prefetch" href="/assets/js/188.467e5fb9.js"><link rel="prefetch" href="/assets/js/189.f4e7f8b2.js"><link rel="prefetch" href="/assets/js/19.ac0e9ed7.js"><link rel="prefetch" href="/assets/js/190.2edbc13e.js"><link rel="prefetch" href="/assets/js/191.744a6848.js"><link rel="prefetch" href="/assets/js/192.1bb07327.js"><link rel="prefetch" href="/assets/js/193.12702071.js"><link rel="prefetch" href="/assets/js/194.15f508e4.js"><link rel="prefetch" href="/assets/js/195.48066006.js"><link rel="prefetch" href="/assets/js/196.4eb490b2.js"><link rel="prefetch" href="/assets/js/197.2cffa063.js"><link rel="prefetch" href="/assets/js/198.e1f0f30b.js"><link rel="prefetch" href="/assets/js/199.5ae111e3.js"><link rel="prefetch" href="/assets/js/20.6c49f026.js"><link rel="prefetch" href="/assets/js/200.5bc674db.js"><link rel="prefetch" href="/assets/js/201.83f9975c.js"><link rel="prefetch" href="/assets/js/202.6a3d7100.js"><link rel="prefetch" href="/assets/js/203.03b6a860.js"><link rel="prefetch" href="/assets/js/204.2db6ba93.js"><link rel="prefetch" href="/assets/js/205.e992b689.js"><link rel="prefetch" href="/assets/js/206.eed8bd42.js"><link rel="prefetch" href="/assets/js/207.92f36aa6.js"><link rel="prefetch" href="/assets/js/208.cd63fa84.js"><link rel="prefetch" href="/assets/js/209.ed9ab8d5.js"><link rel="prefetch" href="/assets/js/21.c20a26ea.js"><link rel="prefetch" href="/assets/js/210.5414f9c2.js"><link rel="prefetch" href="/assets/js/211.94056191.js"><link rel="prefetch" href="/assets/js/212.cfe0a9c3.js"><link rel="prefetch" href="/assets/js/213.3d4abd6e.js"><link rel="prefetch" href="/assets/js/214.e62f8fc5.js"><link rel="prefetch" href="/assets/js/215.433d7113.js"><link rel="prefetch" href="/assets/js/216.ccd1636c.js"><link rel="prefetch" href="/assets/js/217.aeb050b9.js"><link rel="prefetch" href="/assets/js/218.f87af308.js"><link rel="prefetch" href="/assets/js/219.973cfb27.js"><link rel="prefetch" href="/assets/js/22.3563c6e0.js"><link rel="prefetch" href="/assets/js/220.ad665f16.js"><link rel="prefetch" href="/assets/js/221.86c2c9e4.js"><link rel="prefetch" href="/assets/js/222.681ce63b.js"><link rel="prefetch" href="/assets/js/223.dc353c8a.js"><link rel="prefetch" href="/assets/js/224.b9ba4b79.js"><link rel="prefetch" href="/assets/js/225.b9062e20.js"><link rel="prefetch" href="/assets/js/226.58e1fd73.js"><link rel="prefetch" href="/assets/js/227.f44065ae.js"><link rel="prefetch" href="/assets/js/228.26c6c72e.js"><link rel="prefetch" href="/assets/js/229.cddec42f.js"><link rel="prefetch" href="/assets/js/23.f9be176e.js"><link rel="prefetch" href="/assets/js/230.53093373.js"><link rel="prefetch" href="/assets/js/231.880d1b20.js"><link rel="prefetch" href="/assets/js/232.60e4df0d.js"><link rel="prefetch" href="/assets/js/233.36843a48.js"><link rel="prefetch" href="/assets/js/234.1e3e41c7.js"><link rel="prefetch" href="/assets/js/235.e154d363.js"><link rel="prefetch" href="/assets/js/236.bb6fd980.js"><link rel="prefetch" href="/assets/js/237.e7379a75.js"><link rel="prefetch" href="/assets/js/238.3012b35c.js"><link rel="prefetch" href="/assets/js/239.4db4e274.js"><link rel="prefetch" href="/assets/js/24.dd3c04e2.js"><link rel="prefetch" href="/assets/js/240.53e11bb4.js"><link rel="prefetch" href="/assets/js/241.6539a7f9.js"><link rel="prefetch" href="/assets/js/242.2c338449.js"><link rel="prefetch" href="/assets/js/243.b7dce054.js"><link rel="prefetch" href="/assets/js/244.1e3de76d.js"><link rel="prefetch" href="/assets/js/245.001df63f.js"><link rel="prefetch" href="/assets/js/246.48cb97a1.js"><link rel="prefetch" href="/assets/js/247.fa21e7f8.js"><link rel="prefetch" href="/assets/js/248.0dd9b346.js"><link rel="prefetch" href="/assets/js/249.3628bb8f.js"><link rel="prefetch" href="/assets/js/25.ef18cc01.js"><link rel="prefetch" href="/assets/js/250.01fbf76b.js"><link rel="prefetch" href="/assets/js/251.13231102.js"><link rel="prefetch" href="/assets/js/252.0449aade.js"><link rel="prefetch" href="/assets/js/253.a627a1a7.js"><link rel="prefetch" href="/assets/js/254.2493e550.js"><link rel="prefetch" href="/assets/js/255.ac6d41ee.js"><link rel="prefetch" href="/assets/js/256.e611c6b5.js"><link rel="prefetch" href="/assets/js/257.0c9230da.js"><link rel="prefetch" href="/assets/js/258.11cdfae1.js"><link rel="prefetch" href="/assets/js/259.87ba5ef3.js"><link rel="prefetch" href="/assets/js/26.5baa4d2c.js"><link rel="prefetch" href="/assets/js/260.6ee26736.js"><link rel="prefetch" href="/assets/js/261.17972d97.js"><link rel="prefetch" href="/assets/js/262.fabdb15a.js"><link rel="prefetch" href="/assets/js/263.49116ba6.js"><link rel="prefetch" href="/assets/js/264.75cb0c8e.js"><link rel="prefetch" href="/assets/js/265.73430472.js"><link rel="prefetch" href="/assets/js/266.6fd856ec.js"><link rel="prefetch" href="/assets/js/267.67165e17.js"><link rel="prefetch" href="/assets/js/268.cddc62ae.js"><link rel="prefetch" href="/assets/js/269.452ff2d4.js"><link rel="prefetch" href="/assets/js/27.2a2950d8.js"><link rel="prefetch" href="/assets/js/270.a5c429cb.js"><link rel="prefetch" href="/assets/js/271.ce6c21b2.js"><link rel="prefetch" href="/assets/js/272.32934d2b.js"><link rel="prefetch" href="/assets/js/273.2e2c7a19.js"><link rel="prefetch" href="/assets/js/274.6c51e7ae.js"><link rel="prefetch" href="/assets/js/275.24ef01b4.js"><link rel="prefetch" href="/assets/js/276.afeb2acd.js"><link rel="prefetch" href="/assets/js/277.6472c22d.js"><link rel="prefetch" href="/assets/js/278.416d9788.js"><link rel="prefetch" href="/assets/js/279.c190fbc9.js"><link rel="prefetch" href="/assets/js/28.6320d8c1.js"><link rel="prefetch" href="/assets/js/280.28b1b955.js"><link rel="prefetch" href="/assets/js/281.77afd7c5.js"><link rel="prefetch" href="/assets/js/282.c18960ec.js"><link rel="prefetch" href="/assets/js/283.e59fb0e5.js"><link rel="prefetch" href="/assets/js/284.9c6ff275.js"><link rel="prefetch" href="/assets/js/285.b9b17c42.js"><link rel="prefetch" href="/assets/js/286.c7d13ad0.js"><link rel="prefetch" href="/assets/js/287.7cfea342.js"><link rel="prefetch" href="/assets/js/288.f9448d7d.js"><link rel="prefetch" href="/assets/js/289.30726f95.js"><link rel="prefetch" href="/assets/js/29.a420635f.js"><link rel="prefetch" href="/assets/js/290.f79765e2.js"><link rel="prefetch" href="/assets/js/291.0943618c.js"><link rel="prefetch" href="/assets/js/292.bd04f6db.js"><link rel="prefetch" href="/assets/js/293.dfda3b2b.js"><link rel="prefetch" href="/assets/js/294.0a2e9d23.js"><link rel="prefetch" href="/assets/js/295.bd033d69.js"><link rel="prefetch" href="/assets/js/296.1090c539.js"><link rel="prefetch" href="/assets/js/297.ec37f6e8.js"><link rel="prefetch" href="/assets/js/298.fa434214.js"><link rel="prefetch" href="/assets/js/299.50bd7c87.js"><link rel="prefetch" href="/assets/js/30.6c81ca7b.js"><link rel="prefetch" href="/assets/js/300.7a2c6632.js"><link rel="prefetch" href="/assets/js/301.4ae4e645.js"><link rel="prefetch" href="/assets/js/302.e1ef7459.js"><link rel="prefetch" href="/assets/js/303.3894068b.js"><link rel="prefetch" href="/assets/js/304.840b09e3.js"><link rel="prefetch" href="/assets/js/305.40ec0bf6.js"><link rel="prefetch" href="/assets/js/306.9fa4d8aa.js"><link rel="prefetch" href="/assets/js/307.33656e76.js"><link rel="prefetch" href="/assets/js/308.19398f71.js"><link rel="prefetch" href="/assets/js/309.bde6f12f.js"><link rel="prefetch" href="/assets/js/31.2b4f2752.js"><link rel="prefetch" href="/assets/js/310.69ced632.js"><link rel="prefetch" href="/assets/js/311.c8e57d0e.js"><link rel="prefetch" href="/assets/js/312.80c4d6a7.js"><link rel="prefetch" href="/assets/js/313.14060a06.js"><link rel="prefetch" href="/assets/js/314.29165d83.js"><link rel="prefetch" href="/assets/js/315.901aabf1.js"><link rel="prefetch" href="/assets/js/316.d7cb5f30.js"><link rel="prefetch" href="/assets/js/317.15e26404.js"><link rel="prefetch" href="/assets/js/318.85760eca.js"><link rel="prefetch" href="/assets/js/319.1e2eac08.js"><link rel="prefetch" href="/assets/js/32.9cc2a24d.js"><link rel="prefetch" href="/assets/js/320.db086fc7.js"><link rel="prefetch" href="/assets/js/321.69316136.js"><link rel="prefetch" href="/assets/js/322.f93bbdab.js"><link rel="prefetch" href="/assets/js/323.2d67bb75.js"><link rel="prefetch" href="/assets/js/324.c41411db.js"><link rel="prefetch" href="/assets/js/325.a412ca77.js"><link rel="prefetch" href="/assets/js/326.0c247660.js"><link rel="prefetch" href="/assets/js/327.33524443.js"><link rel="prefetch" href="/assets/js/328.cee651db.js"><link rel="prefetch" href="/assets/js/329.9350c363.js"><link rel="prefetch" href="/assets/js/33.705bd0bb.js"><link rel="prefetch" href="/assets/js/330.d01a7e1b.js"><link rel="prefetch" href="/assets/js/331.a3ad2556.js"><link rel="prefetch" href="/assets/js/332.36ad912a.js"><link rel="prefetch" href="/assets/js/333.da27d2cc.js"><link rel="prefetch" href="/assets/js/334.492f9eeb.js"><link rel="prefetch" href="/assets/js/335.072780a2.js"><link rel="prefetch" href="/assets/js/336.454d4374.js"><link rel="prefetch" href="/assets/js/337.dba45eb4.js"><link rel="prefetch" href="/assets/js/338.d2bd2200.js"><link rel="prefetch" href="/assets/js/339.ae85118e.js"><link rel="prefetch" href="/assets/js/34.fa55416d.js"><link rel="prefetch" href="/assets/js/340.7033b85b.js"><link rel="prefetch" href="/assets/js/341.13cfe1aa.js"><link rel="prefetch" href="/assets/js/342.b33302b5.js"><link rel="prefetch" href="/assets/js/343.abd9aba4.js"><link rel="prefetch" href="/assets/js/344.e76aec56.js"><link rel="prefetch" href="/assets/js/345.12433fa3.js"><link rel="prefetch" href="/assets/js/346.b1bdfeba.js"><link rel="prefetch" href="/assets/js/347.53530bff.js"><link rel="prefetch" href="/assets/js/348.66b34aa5.js"><link rel="prefetch" href="/assets/js/349.fbe41e5a.js"><link rel="prefetch" href="/assets/js/35.f4845e0e.js"><link rel="prefetch" href="/assets/js/350.e4b2d6e6.js"><link rel="prefetch" href="/assets/js/351.37aef638.js"><link rel="prefetch" href="/assets/js/352.48b74301.js"><link rel="prefetch" href="/assets/js/353.7fd27c0f.js"><link rel="prefetch" href="/assets/js/354.74ffb3f7.js"><link rel="prefetch" href="/assets/js/355.adb94180.js"><link rel="prefetch" href="/assets/js/356.469ce73f.js"><link rel="prefetch" href="/assets/js/357.f0b7b800.js"><link rel="prefetch" href="/assets/js/358.2a4a9f53.js"><link rel="prefetch" href="/assets/js/359.648aa4f0.js"><link rel="prefetch" href="/assets/js/36.bdebdf29.js"><link rel="prefetch" href="/assets/js/360.05b28f6e.js"><link rel="prefetch" href="/assets/js/361.8c5225b8.js"><link rel="prefetch" href="/assets/js/362.ac0b6ff9.js"><link rel="prefetch" href="/assets/js/363.167f2042.js"><link rel="prefetch" href="/assets/js/364.5940b069.js"><link rel="prefetch" href="/assets/js/365.e429c365.js"><link rel="prefetch" href="/assets/js/366.cc650df8.js"><link rel="prefetch" href="/assets/js/367.347592c9.js"><link rel="prefetch" href="/assets/js/368.d68ce88d.js"><link rel="prefetch" href="/assets/js/369.034e7f1e.js"><link rel="prefetch" href="/assets/js/37.9d026956.js"><link rel="prefetch" href="/assets/js/370.ac6fc7a5.js"><link rel="prefetch" href="/assets/js/371.e70219a6.js"><link rel="prefetch" href="/assets/js/372.c449fc49.js"><link rel="prefetch" href="/assets/js/373.03ff7b1f.js"><link rel="prefetch" href="/assets/js/374.8152408f.js"><link rel="prefetch" href="/assets/js/375.63c70dab.js"><link rel="prefetch" href="/assets/js/376.06de19db.js"><link rel="prefetch" href="/assets/js/377.968e1f62.js"><link rel="prefetch" href="/assets/js/378.d9341c42.js"><link rel="prefetch" href="/assets/js/379.54a13769.js"><link rel="prefetch" href="/assets/js/38.23e83578.js"><link rel="prefetch" href="/assets/js/380.dac4cd46.js"><link rel="prefetch" href="/assets/js/381.8f83d1d7.js"><link rel="prefetch" href="/assets/js/382.e76e7d88.js"><link rel="prefetch" href="/assets/js/383.84a2cb0e.js"><link rel="prefetch" href="/assets/js/384.5093369e.js"><link rel="prefetch" href="/assets/js/385.ee576341.js"><link rel="prefetch" href="/assets/js/386.087a29a9.js"><link rel="prefetch" href="/assets/js/387.94e3e82f.js"><link rel="prefetch" href="/assets/js/388.db594336.js"><link rel="prefetch" href="/assets/js/389.f5396ffc.js"><link rel="prefetch" href="/assets/js/39.e9699d7f.js"><link rel="prefetch" href="/assets/js/390.c377efca.js"><link rel="prefetch" href="/assets/js/391.d7747385.js"><link rel="prefetch" href="/assets/js/392.bf8e8c1a.js"><link rel="prefetch" href="/assets/js/393.b4ed3be0.js"><link rel="prefetch" href="/assets/js/394.48eb505a.js"><link rel="prefetch" href="/assets/js/395.db803949.js"><link rel="prefetch" href="/assets/js/396.f8674e1b.js"><link rel="prefetch" href="/assets/js/397.d19960fa.js"><link rel="prefetch" href="/assets/js/398.15f66e2a.js"><link rel="prefetch" href="/assets/js/399.3bc82adc.js"><link rel="prefetch" href="/assets/js/40.3a541653.js"><link rel="prefetch" href="/assets/js/400.d99e4b93.js"><link rel="prefetch" href="/assets/js/401.13fa06dd.js"><link rel="prefetch" href="/assets/js/402.229d6801.js"><link rel="prefetch" href="/assets/js/403.5826b040.js"><link rel="prefetch" href="/assets/js/404.d4b35549.js"><link rel="prefetch" href="/assets/js/405.9142a002.js"><link rel="prefetch" href="/assets/js/406.ba50e04d.js"><link rel="prefetch" href="/assets/js/407.b5271c6f.js"><link rel="prefetch" href="/assets/js/408.18baa241.js"><link rel="prefetch" href="/assets/js/409.6151d46b.js"><link rel="prefetch" href="/assets/js/41.b10ef41f.js"><link rel="prefetch" href="/assets/js/410.bb1fd058.js"><link rel="prefetch" href="/assets/js/411.9273fd47.js"><link rel="prefetch" href="/assets/js/412.d6b790c1.js"><link rel="prefetch" href="/assets/js/413.4c5a30bb.js"><link rel="prefetch" href="/assets/js/414.01aa0e0a.js"><link rel="prefetch" href="/assets/js/415.9321c4cf.js"><link rel="prefetch" href="/assets/js/416.7a2263a9.js"><link rel="prefetch" href="/assets/js/417.98368241.js"><link rel="prefetch" href="/assets/js/418.ffeb9c9c.js"><link rel="prefetch" href="/assets/js/419.633f9efe.js"><link rel="prefetch" href="/assets/js/42.aa8b7c99.js"><link rel="prefetch" href="/assets/js/420.69868f4a.js"><link rel="prefetch" href="/assets/js/421.937d87cc.js"><link rel="prefetch" href="/assets/js/422.375fe09b.js"><link rel="prefetch" href="/assets/js/423.8d335fd6.js"><link rel="prefetch" href="/assets/js/424.d5b181d7.js"><link rel="prefetch" href="/assets/js/425.9d3bbd92.js"><link rel="prefetch" href="/assets/js/426.1dcc36fa.js"><link rel="prefetch" href="/assets/js/427.c26079c3.js"><link rel="prefetch" href="/assets/js/428.788e60b3.js"><link rel="prefetch" href="/assets/js/429.212c3091.js"><link rel="prefetch" href="/assets/js/43.4543e0d9.js"><link rel="prefetch" href="/assets/js/430.1dc4217d.js"><link rel="prefetch" href="/assets/js/431.b41e44c6.js"><link rel="prefetch" href="/assets/js/432.7af71b66.js"><link rel="prefetch" href="/assets/js/433.3d203e2b.js"><link rel="prefetch" href="/assets/js/434.41bb5350.js"><link rel="prefetch" href="/assets/js/435.fb857c98.js"><link rel="prefetch" href="/assets/js/436.60910866.js"><link rel="prefetch" href="/assets/js/437.3e876081.js"><link rel="prefetch" href="/assets/js/438.52489db1.js"><link rel="prefetch" href="/assets/js/439.0de7c2a4.js"><link rel="prefetch" href="/assets/js/44.c0079627.js"><link rel="prefetch" href="/assets/js/440.43bc725f.js"><link rel="prefetch" href="/assets/js/441.1402dd2a.js"><link rel="prefetch" href="/assets/js/442.6106e1be.js"><link rel="prefetch" href="/assets/js/443.64c24a88.js"><link rel="prefetch" href="/assets/js/444.7c511693.js"><link rel="prefetch" href="/assets/js/445.8636f7a3.js"><link rel="prefetch" href="/assets/js/446.cb623223.js"><link rel="prefetch" href="/assets/js/447.541814ab.js"><link rel="prefetch" href="/assets/js/448.76a49f28.js"><link rel="prefetch" href="/assets/js/449.9ccc7564.js"><link rel="prefetch" href="/assets/js/45.2a09d581.js"><link rel="prefetch" href="/assets/js/450.4a11c620.js"><link rel="prefetch" href="/assets/js/451.ee1b8ff8.js"><link rel="prefetch" href="/assets/js/452.57d90f9d.js"><link rel="prefetch" href="/assets/js/453.39a21d52.js"><link rel="prefetch" href="/assets/js/454.6511d1e1.js"><link rel="prefetch" href="/assets/js/455.0eed4c6d.js"><link rel="prefetch" href="/assets/js/456.52c6b497.js"><link rel="prefetch" href="/assets/js/457.5fa63ace.js"><link rel="prefetch" href="/assets/js/458.c4b97e35.js"><link rel="prefetch" href="/assets/js/459.dd63aef0.js"><link rel="prefetch" href="/assets/js/46.0818f126.js"><link rel="prefetch" href="/assets/js/460.a22ac002.js"><link rel="prefetch" href="/assets/js/461.20961c89.js"><link rel="prefetch" href="/assets/js/462.ee2c5681.js"><link rel="prefetch" href="/assets/js/463.d8d3391e.js"><link rel="prefetch" href="/assets/js/464.f22ba288.js"><link rel="prefetch" href="/assets/js/465.9c187041.js"><link rel="prefetch" href="/assets/js/466.bb610d7e.js"><link rel="prefetch" href="/assets/js/467.2e6d2335.js"><link rel="prefetch" href="/assets/js/468.425b6f20.js"><link rel="prefetch" href="/assets/js/469.3de046d1.js"><link rel="prefetch" href="/assets/js/47.9ffc261e.js"><link rel="prefetch" href="/assets/js/470.56b23b5d.js"><link rel="prefetch" href="/assets/js/471.52f12555.js"><link rel="prefetch" href="/assets/js/472.3a1ad521.js"><link rel="prefetch" href="/assets/js/473.2be352ab.js"><link rel="prefetch" href="/assets/js/474.e9c805de.js"><link rel="prefetch" href="/assets/js/475.93cab6cb.js"><link rel="prefetch" href="/assets/js/476.89384fa4.js"><link rel="prefetch" href="/assets/js/477.2b282ee8.js"><link rel="prefetch" href="/assets/js/478.654c3704.js"><link rel="prefetch" href="/assets/js/479.62e088ac.js"><link rel="prefetch" href="/assets/js/48.e1e2c574.js"><link rel="prefetch" href="/assets/js/480.bd0beea9.js"><link rel="prefetch" href="/assets/js/481.365fe82a.js"><link rel="prefetch" href="/assets/js/482.b42773a2.js"><link rel="prefetch" href="/assets/js/483.06307583.js"><link rel="prefetch" href="/assets/js/484.89fc82a9.js"><link rel="prefetch" href="/assets/js/485.d38ba4c2.js"><link rel="prefetch" href="/assets/js/486.ed91c8b7.js"><link rel="prefetch" href="/assets/js/487.18010c30.js"><link rel="prefetch" href="/assets/js/488.b4a6f06e.js"><link rel="prefetch" href="/assets/js/489.7c7adc5c.js"><link rel="prefetch" href="/assets/js/49.86de3a64.js"><link rel="prefetch" href="/assets/js/490.3f86a6a4.js"><link rel="prefetch" href="/assets/js/491.c1c90b4f.js"><link rel="prefetch" href="/assets/js/492.9b0b2968.js"><link rel="prefetch" href="/assets/js/493.ab4f5219.js"><link rel="prefetch" href="/assets/js/494.80e3d4f4.js"><link rel="prefetch" href="/assets/js/495.cd43108c.js"><link rel="prefetch" href="/assets/js/496.cc77f0cc.js"><link rel="prefetch" href="/assets/js/497.7f012a61.js"><link rel="prefetch" href="/assets/js/498.e2dcd450.js"><link rel="prefetch" href="/assets/js/499.1eb65f15.js"><link rel="prefetch" href="/assets/js/5.f343fd5d.js"><link rel="prefetch" href="/assets/js/50.eaf6c9df.js"><link rel="prefetch" href="/assets/js/500.a8dff429.js"><link rel="prefetch" href="/assets/js/501.08ff03e1.js"><link rel="prefetch" href="/assets/js/502.7d4d351b.js"><link rel="prefetch" href="/assets/js/503.b72fa6a8.js"><link rel="prefetch" href="/assets/js/504.60780a8e.js"><link rel="prefetch" href="/assets/js/505.56edff2f.js"><link rel="prefetch" href="/assets/js/506.25473979.js"><link rel="prefetch" href="/assets/js/507.3cf0d2d7.js"><link rel="prefetch" href="/assets/js/508.b1384524.js"><link rel="prefetch" href="/assets/js/509.a4321e30.js"><link rel="prefetch" href="/assets/js/51.bc8d5aaf.js"><link rel="prefetch" href="/assets/js/510.266a6048.js"><link rel="prefetch" href="/assets/js/511.6449c5f4.js"><link rel="prefetch" href="/assets/js/512.46d7ec78.js"><link rel="prefetch" href="/assets/js/513.837b9052.js"><link rel="prefetch" href="/assets/js/514.6367dfac.js"><link rel="prefetch" href="/assets/js/515.c08327b5.js"><link rel="prefetch" href="/assets/js/516.3b4189d4.js"><link rel="prefetch" href="/assets/js/517.30f6149f.js"><link rel="prefetch" href="/assets/js/518.543bea6f.js"><link rel="prefetch" href="/assets/js/519.5203f10c.js"><link rel="prefetch" href="/assets/js/52.20603f07.js"><link rel="prefetch" href="/assets/js/520.0a3034db.js"><link rel="prefetch" href="/assets/js/521.40210ec3.js"><link rel="prefetch" href="/assets/js/522.6ae45427.js"><link rel="prefetch" href="/assets/js/523.4b5d705c.js"><link rel="prefetch" href="/assets/js/524.24354cd8.js"><link rel="prefetch" href="/assets/js/525.d201b688.js"><link rel="prefetch" href="/assets/js/526.5a310047.js"><link rel="prefetch" href="/assets/js/527.f21b5ed9.js"><link rel="prefetch" href="/assets/js/528.cb45a5dd.js"><link rel="prefetch" href="/assets/js/529.aeec69e2.js"><link rel="prefetch" href="/assets/js/53.3dfede5f.js"><link rel="prefetch" href="/assets/js/530.7d5514c0.js"><link rel="prefetch" href="/assets/js/531.232875bc.js"><link rel="prefetch" href="/assets/js/532.31b6e993.js"><link rel="prefetch" href="/assets/js/533.23335bff.js"><link rel="prefetch" href="/assets/js/534.131d260d.js"><link rel="prefetch" href="/assets/js/535.325fb780.js"><link rel="prefetch" href="/assets/js/536.3a6e04f7.js"><link rel="prefetch" href="/assets/js/537.fba0dff9.js"><link rel="prefetch" href="/assets/js/538.484e78e3.js"><link rel="prefetch" href="/assets/js/539.f5b9d795.js"><link rel="prefetch" href="/assets/js/54.0672652f.js"><link rel="prefetch" href="/assets/js/540.e1469d60.js"><link rel="prefetch" href="/assets/js/541.19aca35c.js"><link rel="prefetch" href="/assets/js/542.ef21521b.js"><link rel="prefetch" href="/assets/js/543.28f4c11d.js"><link rel="prefetch" href="/assets/js/544.7a557763.js"><link rel="prefetch" href="/assets/js/545.d4a3a0b1.js"><link rel="prefetch" href="/assets/js/546.8227bb93.js"><link rel="prefetch" href="/assets/js/547.a25f9f1f.js"><link rel="prefetch" href="/assets/js/548.75912f14.js"><link rel="prefetch" href="/assets/js/549.f7913ea7.js"><link rel="prefetch" href="/assets/js/55.eccc64f8.js"><link rel="prefetch" href="/assets/js/550.c127415f.js"><link rel="prefetch" href="/assets/js/551.b0fb00d7.js"><link rel="prefetch" href="/assets/js/552.65dd0c96.js"><link rel="prefetch" href="/assets/js/553.8f54c217.js"><link rel="prefetch" href="/assets/js/554.0f0110aa.js"><link rel="prefetch" href="/assets/js/555.20d92271.js"><link rel="prefetch" href="/assets/js/556.eaa87d9e.js"><link rel="prefetch" href="/assets/js/557.56935b3b.js"><link rel="prefetch" href="/assets/js/558.2663dd29.js"><link rel="prefetch" href="/assets/js/559.64b054ed.js"><link rel="prefetch" href="/assets/js/56.17ce588e.js"><link rel="prefetch" href="/assets/js/560.96438103.js"><link rel="prefetch" href="/assets/js/561.3f954ead.js"><link rel="prefetch" href="/assets/js/562.af9ebd91.js"><link rel="prefetch" href="/assets/js/563.ddd66296.js"><link rel="prefetch" href="/assets/js/564.2f68f72a.js"><link rel="prefetch" href="/assets/js/565.01bce6c3.js"><link rel="prefetch" href="/assets/js/566.a52f9105.js"><link rel="prefetch" href="/assets/js/567.859ac364.js"><link rel="prefetch" href="/assets/js/568.5b8b956b.js"><link rel="prefetch" href="/assets/js/569.0579b985.js"><link rel="prefetch" href="/assets/js/57.b5fa419a.js"><link rel="prefetch" href="/assets/js/570.d09f7f64.js"><link rel="prefetch" href="/assets/js/571.56e5f721.js"><link rel="prefetch" href="/assets/js/572.df9b48f1.js"><link rel="prefetch" href="/assets/js/573.224ada77.js"><link rel="prefetch" href="/assets/js/574.b86bedad.js"><link rel="prefetch" href="/assets/js/575.5de505a0.js"><link rel="prefetch" href="/assets/js/576.3f005df8.js"><link rel="prefetch" href="/assets/js/577.67c56f69.js"><link rel="prefetch" href="/assets/js/578.ecc86424.js"><link rel="prefetch" href="/assets/js/579.97aaa2ed.js"><link rel="prefetch" href="/assets/js/58.f28ad3cc.js"><link rel="prefetch" href="/assets/js/580.227b7eac.js"><link rel="prefetch" href="/assets/js/581.fb9b8da8.js"><link rel="prefetch" href="/assets/js/582.56048491.js"><link rel="prefetch" href="/assets/js/583.7b73623c.js"><link rel="prefetch" href="/assets/js/584.f0d8c622.js"><link rel="prefetch" href="/assets/js/585.3501b2bf.js"><link rel="prefetch" href="/assets/js/586.c359098c.js"><link rel="prefetch" href="/assets/js/587.5f4468bd.js"><link rel="prefetch" href="/assets/js/588.13f6d1b8.js"><link rel="prefetch" href="/assets/js/589.3aba094e.js"><link rel="prefetch" href="/assets/js/59.9079a4f5.js"><link rel="prefetch" href="/assets/js/590.66f0672c.js"><link rel="prefetch" href="/assets/js/591.e4de1988.js"><link rel="prefetch" href="/assets/js/592.f479d891.js"><link rel="prefetch" href="/assets/js/593.f0e27fdf.js"><link rel="prefetch" href="/assets/js/594.13045593.js"><link rel="prefetch" href="/assets/js/595.24cce867.js"><link rel="prefetch" href="/assets/js/596.c5f1641f.js"><link rel="prefetch" href="/assets/js/597.5d8c531f.js"><link rel="prefetch" href="/assets/js/598.a4f73bf5.js"><link rel="prefetch" href="/assets/js/599.b9db932d.js"><link rel="prefetch" href="/assets/js/6.20e5c5a2.js"><link rel="prefetch" href="/assets/js/60.de27b06a.js"><link rel="prefetch" href="/assets/js/600.7dbabf0f.js"><link rel="prefetch" href="/assets/js/601.34cfecd2.js"><link rel="prefetch" href="/assets/js/602.afaf2e1f.js"><link rel="prefetch" href="/assets/js/603.5f081041.js"><link rel="prefetch" href="/assets/js/604.a55dc3e4.js"><link rel="prefetch" href="/assets/js/605.cc600bca.js"><link rel="prefetch" href="/assets/js/606.9e0874e1.js"><link rel="prefetch" href="/assets/js/607.bd0a2835.js"><link rel="prefetch" href="/assets/js/608.e3c0bb6d.js"><link rel="prefetch" href="/assets/js/609.968adfbe.js"><link rel="prefetch" href="/assets/js/61.cd58c0e2.js"><link rel="prefetch" href="/assets/js/610.6ddb82e2.js"><link rel="prefetch" href="/assets/js/611.f6573e33.js"><link rel="prefetch" href="/assets/js/612.cd703232.js"><link rel="prefetch" href="/assets/js/613.5ae48097.js"><link rel="prefetch" href="/assets/js/614.c9fc5628.js"><link rel="prefetch" href="/assets/js/615.5f3c1162.js"><link rel="prefetch" href="/assets/js/616.3efeed17.js"><link rel="prefetch" href="/assets/js/617.25dec672.js"><link rel="prefetch" href="/assets/js/618.c06b0d32.js"><link rel="prefetch" href="/assets/js/619.5d866d4c.js"><link rel="prefetch" href="/assets/js/62.aa4d202d.js"><link rel="prefetch" href="/assets/js/620.88136c6a.js"><link rel="prefetch" href="/assets/js/621.494122df.js"><link rel="prefetch" href="/assets/js/622.e2a6e4bd.js"><link rel="prefetch" href="/assets/js/623.20a56d61.js"><link rel="prefetch" href="/assets/js/624.602dd933.js"><link rel="prefetch" href="/assets/js/625.70f44f60.js"><link rel="prefetch" href="/assets/js/626.11524978.js"><link rel="prefetch" href="/assets/js/627.b3badb72.js"><link rel="prefetch" href="/assets/js/628.e613665e.js"><link rel="prefetch" href="/assets/js/629.20e73b43.js"><link rel="prefetch" href="/assets/js/63.f7cd40f4.js"><link rel="prefetch" href="/assets/js/630.b6b6993b.js"><link rel="prefetch" href="/assets/js/631.a54facea.js"><link rel="prefetch" href="/assets/js/632.d33f5ec9.js"><link rel="prefetch" href="/assets/js/633.211456ee.js"><link rel="prefetch" href="/assets/js/634.ea9d07ae.js"><link rel="prefetch" href="/assets/js/635.f22368f1.js"><link rel="prefetch" href="/assets/js/636.64523984.js"><link rel="prefetch" href="/assets/js/637.6e8d116d.js"><link rel="prefetch" href="/assets/js/638.4565c395.js"><link rel="prefetch" href="/assets/js/639.c5144f9c.js"><link rel="prefetch" href="/assets/js/64.32e36797.js"><link rel="prefetch" href="/assets/js/640.2dc2eba9.js"><link rel="prefetch" href="/assets/js/641.70155ce7.js"><link rel="prefetch" href="/assets/js/642.c55f5ca8.js"><link rel="prefetch" href="/assets/js/643.69a5b8e5.js"><link rel="prefetch" href="/assets/js/644.e4c69ba3.js"><link rel="prefetch" href="/assets/js/645.f8972cce.js"><link rel="prefetch" href="/assets/js/646.506fc745.js"><link rel="prefetch" href="/assets/js/647.e5f03652.js"><link rel="prefetch" href="/assets/js/648.47ae0cc5.js"><link rel="prefetch" href="/assets/js/649.b3a67529.js"><link rel="prefetch" href="/assets/js/65.9b846f9f.js"><link rel="prefetch" href="/assets/js/650.89765bb0.js"><link rel="prefetch" href="/assets/js/651.19b73cf8.js"><link rel="prefetch" href="/assets/js/652.4436725f.js"><link rel="prefetch" href="/assets/js/653.391168ff.js"><link rel="prefetch" href="/assets/js/654.8b449d07.js"><link rel="prefetch" href="/assets/js/655.27051c8c.js"><link rel="prefetch" href="/assets/js/656.7adaae31.js"><link rel="prefetch" href="/assets/js/657.4fee46d2.js"><link rel="prefetch" href="/assets/js/658.0243a6e8.js"><link rel="prefetch" href="/assets/js/659.fc6c50f4.js"><link rel="prefetch" href="/assets/js/66.87cbf0a3.js"><link rel="prefetch" href="/assets/js/660.f0794bab.js"><link rel="prefetch" href="/assets/js/661.980d3d5a.js"><link rel="prefetch" href="/assets/js/662.79643730.js"><link rel="prefetch" href="/assets/js/663.d030bd1d.js"><link rel="prefetch" href="/assets/js/664.32b3c0e8.js"><link rel="prefetch" href="/assets/js/665.384c456b.js"><link rel="prefetch" href="/assets/js/666.2672eb36.js"><link rel="prefetch" href="/assets/js/667.2ca85ff9.js"><link rel="prefetch" href="/assets/js/668.b80ef3b4.js"><link rel="prefetch" href="/assets/js/669.41f08cb1.js"><link rel="prefetch" href="/assets/js/67.c0e799e4.js"><link rel="prefetch" href="/assets/js/670.48512f45.js"><link rel="prefetch" href="/assets/js/671.93e1cdd9.js"><link rel="prefetch" href="/assets/js/672.aa2a7e31.js"><link rel="prefetch" href="/assets/js/673.b19ed80d.js"><link rel="prefetch" href="/assets/js/674.0337bf32.js"><link rel="prefetch" href="/assets/js/675.88a9d569.js"><link rel="prefetch" href="/assets/js/676.7fd2de1c.js"><link rel="prefetch" href="/assets/js/677.1356b477.js"><link rel="prefetch" href="/assets/js/678.d99fd658.js"><link rel="prefetch" href="/assets/js/679.a2e40bc7.js"><link rel="prefetch" href="/assets/js/68.a0900b05.js"><link rel="prefetch" href="/assets/js/680.58e5d76e.js"><link rel="prefetch" href="/assets/js/681.2e66d773.js"><link rel="prefetch" href="/assets/js/682.42526013.js"><link rel="prefetch" href="/assets/js/683.447d4972.js"><link rel="prefetch" href="/assets/js/684.19beb22a.js"><link rel="prefetch" href="/assets/js/685.cd3fd615.js"><link rel="prefetch" href="/assets/js/686.c6200f3f.js"><link rel="prefetch" href="/assets/js/687.3d6cf8bb.js"><link rel="prefetch" href="/assets/js/688.e9ddd041.js"><link rel="prefetch" href="/assets/js/689.d9ae26a7.js"><link rel="prefetch" href="/assets/js/69.46e92a94.js"><link rel="prefetch" href="/assets/js/690.82b51acd.js"><link rel="prefetch" href="/assets/js/691.1de98534.js"><link rel="prefetch" href="/assets/js/692.c5fd2fa7.js"><link rel="prefetch" href="/assets/js/693.0c0b8126.js"><link rel="prefetch" href="/assets/js/694.551ae4d1.js"><link rel="prefetch" href="/assets/js/695.2801a2f2.js"><link rel="prefetch" href="/assets/js/696.b042b472.js"><link rel="prefetch" href="/assets/js/697.2268ef66.js"><link rel="prefetch" href="/assets/js/698.083f2a36.js"><link rel="prefetch" href="/assets/js/699.c82907d3.js"><link rel="prefetch" href="/assets/js/7.54cc9ff2.js"><link rel="prefetch" href="/assets/js/70.358bb057.js"><link rel="prefetch" href="/assets/js/700.9faf8917.js"><link rel="prefetch" href="/assets/js/701.5ce77f04.js"><link rel="prefetch" href="/assets/js/702.488262eb.js"><link rel="prefetch" href="/assets/js/703.8f79363d.js"><link rel="prefetch" href="/assets/js/704.a4cfe8cb.js"><link rel="prefetch" href="/assets/js/705.4f1759eb.js"><link rel="prefetch" href="/assets/js/706.d69115ff.js"><link rel="prefetch" href="/assets/js/707.48c01840.js"><link rel="prefetch" href="/assets/js/708.b3cda177.js"><link rel="prefetch" href="/assets/js/709.260cc3a8.js"><link rel="prefetch" href="/assets/js/71.aef535c9.js"><link rel="prefetch" href="/assets/js/710.e4fa6646.js"><link rel="prefetch" href="/assets/js/711.7816aba5.js"><link rel="prefetch" href="/assets/js/712.14939ffd.js"><link rel="prefetch" href="/assets/js/72.9793c1ce.js"><link rel="prefetch" href="/assets/js/73.ac8cddbb.js"><link rel="prefetch" href="/assets/js/74.1d313482.js"><link rel="prefetch" href="/assets/js/75.d22f9016.js"><link rel="prefetch" href="/assets/js/76.18b52e68.js"><link rel="prefetch" href="/assets/js/77.f9258c97.js"><link rel="prefetch" href="/assets/js/78.55656c0f.js"><link rel="prefetch" href="/assets/js/79.12ecc291.js"><link rel="prefetch" href="/assets/js/8.44118d7c.js"><link rel="prefetch" href="/assets/js/80.6047e44e.js"><link rel="prefetch" href="/assets/js/81.5421fa90.js"><link rel="prefetch" href="/assets/js/82.72a10ccf.js"><link rel="prefetch" href="/assets/js/83.abdca93e.js"><link rel="prefetch" href="/assets/js/84.890d0c52.js"><link rel="prefetch" href="/assets/js/85.9b610a1c.js"><link rel="prefetch" href="/assets/js/86.b68daf67.js"><link rel="prefetch" href="/assets/js/87.bfe2bb57.js"><link rel="prefetch" href="/assets/js/88.4097611c.js"><link rel="prefetch" href="/assets/js/89.e5a98da0.js"><link rel="prefetch" href="/assets/js/9.612b54fd.js"><link rel="prefetch" href="/assets/js/90.04e01a5c.js"><link rel="prefetch" href="/assets/js/91.ff219511.js"><link rel="prefetch" href="/assets/js/92.c257263c.js"><link rel="prefetch" href="/assets/js/93.4b6ecb16.js"><link rel="prefetch" href="/assets/js/94.fd999a73.js"><link rel="prefetch" href="/assets/js/95.d1dbefdc.js"><link rel="prefetch" href="/assets/js/96.0ed81c74.js"><link rel="prefetch" href="/assets/js/97.f2650da8.js"><link rel="prefetch" href="/assets/js/98.f9ef7bdb.js"><link rel="prefetch" href="/assets/js/99.2d7ddb43.js"><link rel="prefetch" href="/assets/js/vendors~docsearch.49ad9c45.js">
    <link rel="stylesheet" href="/assets/css/0.styles.28585500.css">
  </head>
  <body>
    <div id="app" data-server-rendered="true"><div class="theme-container"><header class="navbar"><div class="sidebar-button"><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" role="img" viewBox="0 0 448 512" class="icon"><path fill="currentColor" d="M436 124H12c-6.627 0-12-5.373-12-12V80c0-6.627 5.373-12 12-12h424c6.627 0 12 5.373 12 12v32c0 6.627-5.373 12-12 12zm0 160H12c-6.627 0-12-5.373-12-12v-32c0-6.627 5.373-12 12-12h424c6.627 0 12 5.373 12 12v32c0 6.627-5.373 12-12 12zm0 160H12c-6.627 0-12-5.373-12-12v-32c0-6.627 5.373-12 12-12h424c6.627 0 12 5.373 12 12v32c0 6.627-5.373 12-12 12z"></path></svg></div> <a href="/en/" class="home-link router-link-active"><img src="/images/icons/spring-logo.svg" alt="Spring Docs" class="logo"> <span class="site-name can-hide">Spring Docs</span></a> <div class="links"><div class="search-box"><input aria-label="Search" autocomplete="off" spellcheck="false" value=""> <!----></div> <nav class="nav-links can-hide"><div class="nav-item"><a href="/en/spring/why-spring.html" class="nav-link">
  Spring
</a></div><div class="nav-item"><a href="/en/spring-boot/getting-help.html" class="nav-link">
  Spring Boot
</a></div><div class="nav-item"><a href="/en/spring-cloud/documentation-overview.html" class="nav-link">
  Spring Cloud
</a></div><div class="nav-item"><div class="dropdown-wrapper"><button type="button" aria-label="Others" class="dropdown-title"><span class="title">more</span> <span class="arrow down"></span></button> <button type="button" aria-label="Others" class="mobile-dropdown-title"><span class="title">more</span> <span class="arrow right"></span></button> <ul class="nav-dropdown" style="display:none;"><li class="dropdown-item"><!----> <a href="/en/spring-framework/overview.html" class="nav-link">
  Spring Framework
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-data/spring-data.html" class="nav-link">
  Spring Data
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-cloud-data-flow/spring-cloud-dataflow.html" class="nav-link">
  Spring Cloud Data Flow
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-security/overview.html" class="nav-link">
  Spring Security
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-for-graphql/spring-graphql.html" class="nav-link">
  Spring for GraphQL
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-session/_index.html" class="nav-link">
  Spring Session
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-integration/preface.html" class="nav-link">
  Spring Integration
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-hateoas/spring-hateoas.html" class="nav-link">
  Spring HATEOAS
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-rest-docs/spring-restdocs.html" class="nav-link">
  Spring REST Docs
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-batch/spring-batch-intro.html" class="nav-link">
  Spring Batch
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-amqp/spring-amqp.html" class="nav-link">
  Spring AMQP
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-credhub/spring-credhub.html" class="nav-link">
  Spring CredHub
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-flo/spring-flo.html" class="nav-link">
  Spring Flo
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-for-apache-kafka/spring-kafka.html" class="nav-link">
  Spring for Apache Kafka
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-ldap/spring-ldap.html" class="nav-link">
  Spring LDAP
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-shell/spring-shell.html" class="nav-link">
  Spring Shell
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-statemachine/spring-statemachine.html" class="nav-link">
  Spring Statemachine
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-vault/spring-vault.html" class="nav-link">
  Spring Vault
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-web-flow/preface.html" class="nav-link">
  Spring Web Flow
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-web-services/spring-web-service.html" class="nav-link">
  Spring Web Services
</a></li></ul></div></div><div class="nav-item"><div class="dropdown-wrapper"><button type="button" aria-label="Select language" class="dropdown-title"><span class="title">Language</span> <span class="arrow down"></span></button> <button type="button" aria-label="Select language" class="mobile-dropdown-title"><span class="title">Language</span> <span class="arrow right"></span></button> <ul class="nav-dropdown" style="display:none;"><li class="dropdown-item"><!----> <a href="/en/spring-security/features-exploits-csrf.html" aria-current="page" class="nav-link router-link-exact-active router-link-active">
  English
</a></li><li class="dropdown-item"><!----> <a href="/spring-security/features-exploits-csrf.html" class="nav-link">
  简体中文
</a></li></ul></div></div> <a href="https://gitcode.net/dev-cloud/spring-docs" target="_blank" rel="noopener noreferrer" class="repo-link">
    GitCode
    <span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a></nav></div></header> <div class="sidebar-mask"></div> <aside class="sidebar"><nav class="nav-links"><div class="nav-item"><a href="/en/spring/why-spring.html" class="nav-link">
  Spring
</a></div><div class="nav-item"><a href="/en/spring-boot/getting-help.html" class="nav-link">
  Spring Boot
</a></div><div class="nav-item"><a href="/en/spring-cloud/documentation-overview.html" class="nav-link">
  Spring Cloud
</a></div><div class="nav-item"><div class="dropdown-wrapper"><button type="button" aria-label="Others" class="dropdown-title"><span class="title">more</span> <span class="arrow down"></span></button> <button type="button" aria-label="Others" class="mobile-dropdown-title"><span class="title">more</span> <span class="arrow right"></span></button> <ul class="nav-dropdown" style="display:none;"><li class="dropdown-item"><!----> <a href="/en/spring-framework/overview.html" class="nav-link">
  Spring Framework
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-data/spring-data.html" class="nav-link">
  Spring Data
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-cloud-data-flow/spring-cloud-dataflow.html" class="nav-link">
  Spring Cloud Data Flow
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-security/overview.html" class="nav-link">
  Spring Security
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-for-graphql/spring-graphql.html" class="nav-link">
  Spring for GraphQL
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-session/_index.html" class="nav-link">
  Spring Session
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-integration/preface.html" class="nav-link">
  Spring Integration
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-hateoas/spring-hateoas.html" class="nav-link">
  Spring HATEOAS
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-rest-docs/spring-restdocs.html" class="nav-link">
  Spring REST Docs
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-batch/spring-batch-intro.html" class="nav-link">
  Spring Batch
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-amqp/spring-amqp.html" class="nav-link">
  Spring AMQP
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-credhub/spring-credhub.html" class="nav-link">
  Spring CredHub
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-flo/spring-flo.html" class="nav-link">
  Spring Flo
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-for-apache-kafka/spring-kafka.html" class="nav-link">
  Spring for Apache Kafka
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-ldap/spring-ldap.html" class="nav-link">
  Spring LDAP
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-shell/spring-shell.html" class="nav-link">
  Spring Shell
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-statemachine/spring-statemachine.html" class="nav-link">
  Spring Statemachine
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-vault/spring-vault.html" class="nav-link">
  Spring Vault
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-web-flow/preface.html" class="nav-link">
  Spring Web Flow
</a></li><li class="dropdown-item"><!----> <a href="/en/spring-web-services/spring-web-service.html" class="nav-link">
  Spring Web Services
</a></li></ul></div></div><div class="nav-item"><div class="dropdown-wrapper"><button type="button" aria-label="Select language" class="dropdown-title"><span class="title">Language</span> <span class="arrow down"></span></button> <button type="button" aria-label="Select language" class="mobile-dropdown-title"><span class="title">Language</span> <span class="arrow right"></span></button> <ul class="nav-dropdown" style="display:none;"><li class="dropdown-item"><!----> <a href="/en/spring-security/features-exploits-csrf.html" aria-current="page" class="nav-link router-link-exact-active router-link-active">
  English
</a></li><li class="dropdown-item"><!----> <a href="/spring-security/features-exploits-csrf.html" class="nav-link">
  简体中文
</a></li></ul></div></div> <a href="https://gitcode.net/dev-cloud/spring-docs" target="_blank" rel="noopener noreferrer" class="repo-link">
    GitCode
    <span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a></nav>  <ul class="sidebar-links"><li><section class="sidebar-group depth-0"><p class="sidebar-heading open"><span>Spring Security</span> <!----></p> <ul class="sidebar-links sidebar-group-items"><li><a href="/en/spring-security/overview.html" class="sidebar-link">Spring Security</a></li><li><a href="/en/spring-security/prerequisites.html" class="sidebar-link">Prerequisites</a></li><li><a href="/en/spring-security/community.html" class="sidebar-link">Spring Security Community</a></li><li><a href="/en/spring-security/whats-new.html" class="sidebar-link">What’s New in Spring Security 5.6</a></li><li><a href="/en/spring-security/getting-spring-security.html" class="sidebar-link">Getting Spring Security</a></li><li><a href="/en/spring-security/features.html" class="sidebar-link">Features</a></li><li><a href="/en/spring-security/features-authentication.html" class="sidebar-link">Authentication</a></li><li><a href="/en/spring-security/features-authentication-password-storage.html" class="sidebar-link">Password Storage</a></li><li><a href="/en/spring-security/features-exploits.html" class="sidebar-link">Protection Against Exploits</a></li><li><a href="/en/spring-security/features-exploits-csrf.html" aria-current="page" class="active sidebar-link">Cross Site Request Forgery (CSRF)</a><ul class="sidebar-sub-headers"><li class="sidebar-sub-header"><a href="/en/spring-security/features-exploits-csrf.html#what-is-a-csrf-attack" class="sidebar-link">What is a CSRF Attack?</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-exploits-csrf.html#protecting-against-csrf-attacks" class="sidebar-link">Protecting Against CSRF Attacks</a><ul class="sidebar-sub-headers"><li class="sidebar-sub-header"><a href="/en/spring-security/features-exploits-csrf.html#safe-methods-must-be-idempotent" class="sidebar-link">Safe Methods Must be Idempotent</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-exploits-csrf.html#synchronizer-token-pattern" class="sidebar-link">Synchronizer Token Pattern</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-exploits-csrf.html#samesite-attribute" class="sidebar-link">SameSite Attribute</a></li></ul></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-exploits-csrf.html#when-to-use-csrf-protection" class="sidebar-link">When to use CSRF protection</a><ul class="sidebar-sub-headers"><li class="sidebar-sub-header"><a href="/en/spring-security/features-exploits-csrf.html#csrf-protection-and-json" class="sidebar-link">CSRF protection and JSON</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-exploits-csrf.html#csrf-and-stateless-browser-applications" class="sidebar-link">CSRF and Stateless Browser Applications</a></li></ul></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-exploits-csrf.html#csrf-considerations" class="sidebar-link">CSRF Considerations</a><ul class="sidebar-sub-headers"><li class="sidebar-sub-header"><a href="/en/spring-security/features-exploits-csrf.html#logging-in" class="sidebar-link">Logging In</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-exploits-csrf.html#logging-out" class="sidebar-link">Logging Out</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-exploits-csrf.html#csrf-and-session-timeouts" class="sidebar-link">CSRF and Session Timeouts</a></li><li class="sidebar-sub-header"><a href="/en/spring-security/features-exploits-csrf.html#" class="sidebar-link"></a></li></ul></li></ul></li><li><a href="/en/spring-security/features-exploits-headers.html" class="sidebar-link">Security HTTP Response Headers</a></li><li><a href="/en/spring-security/features-exploits-http.html" class="sidebar-link">HTTP</a></li><li><a href="/en/spring-security/features-integrations.html" class="sidebar-link">Integrations</a></li><li><a href="/en/spring-security/features-integrations-cryptography.html" class="sidebar-link">Spring Security Crypto Module</a></li><li><a href="/en/spring-security/features-integrations-data.html" class="sidebar-link">Spring Data Integration</a></li><li><a href="/en/spring-security/features-integrations-concurrency.html" class="sidebar-link">Concurrency Support</a></li><li><a href="/en/spring-security/features-integrations-jackson.html" class="sidebar-link">Jackson Support</a></li><li><a href="/en/spring-security/features-integrations-localization.html" class="sidebar-link">Localization</a></li><li><a href="/en/spring-security/modules.html" class="sidebar-link">Project Modules and Dependencies</a></li><li><a href="/en/spring-security/samples.html" class="sidebar-link">Samples</a></li><li><a href="/en/spring-security/servlet.html" class="sidebar-link">Servlet Applications</a></li><li><a href="/en/spring-security/servlet-getting-started.html" class="sidebar-link">Hello Spring Security</a></li><li><a href="/en/spring-security/servlet-architecture.html" class="sidebar-link">Architecture</a></li><li><a href="/en/spring-security/servlet-authentication.html" class="sidebar-link">Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-architecture.html" class="sidebar-link">Servlet Authentication Architecture</a></li><li><a href="/en/spring-security/servlet-authentication-passwords.html" class="sidebar-link">Username/Password Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-input.html" class="sidebar-link">Reading the Username &amp; Password</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-form.html" class="sidebar-link">Form Login</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-basic.html" class="sidebar-link">Basic Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-digest.html" class="sidebar-link">Digest Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-storage.html" class="sidebar-link">Storage Mechanisms</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-storage-in-memory.html" class="sidebar-link">In-Memory Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-storage-jdbc.html" class="sidebar-link">JDBC Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-storage-user-details.html" class="sidebar-link">UserDetails</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-storage-user-details-service.html" class="sidebar-link">UserDetailsService</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-storage-password-encoder.html" class="sidebar-link">PasswordEncoder</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-storage-dao-authentication-provider.html" class="sidebar-link">DaoAuthenticationProvider</a></li><li><a href="/en/spring-security/servlet-authentication-passwords-storage-ldap.html" class="sidebar-link">LDAP Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-session-management.html" class="sidebar-link">Session Management</a></li><li><a href="/en/spring-security/servlet-authentication-rememberme.html" class="sidebar-link">Remember-Me Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-openid.html" class="sidebar-link">OpenID Support</a></li><li><a href="/en/spring-security/servlet-authentication-anonymous.html" class="sidebar-link">Anonymous Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-preauth.html" class="sidebar-link">Pre-Authentication Scenarios</a></li><li><a href="/en/spring-security/servlet-authentication-jaas.html" class="sidebar-link">Java Authentication and Authorization Service (JAAS) Provider</a></li><li><a href="/en/spring-security/servlet-authentication-cas.html" class="sidebar-link">CAS Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-x509.html" class="sidebar-link">X.509 Authentication</a></li><li><a href="/en/spring-security/servlet-authentication-runas.html" class="sidebar-link">Run-As Authentication Replacement</a></li><li><a href="/en/spring-security/servlet-authentication-logout.html" class="sidebar-link">Handling Logouts</a></li><li><a href="/en/spring-security/servlet-authentication-events.html" class="sidebar-link">Authentication Events</a></li><li><a href="/en/spring-security/servlet-authorization-.html" class="sidebar-link">Authorization</a></li><li><a href="/en/spring-security/servlet-authorization-architecture.html" class="sidebar-link">Authorization Architecture</a></li><li><a href="/en/spring-security/servlet-authorization-authorize-http-requests.html" class="sidebar-link">Authorize HttpServletRequests with AuthorizationFilter</a></li><li><a href="/en/spring-security/servlet-authorization-authorize-requests.html" class="sidebar-link">Authorize HttpServletRequest with FilterSecurityInterceptor</a></li><li><a href="/en/spring-security/servlet-authorization-expression-based.html" class="sidebar-link">Expression-Based Access Control</a></li><li><a href="/en/spring-security/servlet-authorization-secure-objects.html" class="sidebar-link">Secure Object Implementations</a></li><li><a href="/en/spring-security/servlet-authorization-method-security.html" class="sidebar-link">Method Security</a></li><li><a href="/en/spring-security/servlet-authorization-acls.html" class="sidebar-link">Domain Object Security (ACLs)</a></li><li><a href="/en/spring-security/servlet-oauth2-.html" class="sidebar-link">OAuth2</a></li><li><a href="/en/spring-security/servlet-oauth2-login.html" class="sidebar-link">OAuth 2.0 Login</a></li><li><a href="/en/spring-security/servlet-oauth2-login-core.html" class="sidebar-link">Core Configuration</a></li><li><a href="/en/spring-security/servlet-oauth2-login-advanced.html" class="sidebar-link">Advanced Configuration</a></li><li><a href="/en/spring-security/servlet-oauth2-client.html" class="sidebar-link">OAuth 2.0 Client</a></li><li><a href="/en/spring-security/servlet-oauth2-client-core.html" class="sidebar-link">Core Interfaces / Classes</a></li><li><a href="/en/spring-security/servlet-oauth2-client-authorization-grants.html" class="sidebar-link">Authorization Grant Support</a></li><li><a href="/en/spring-security/servlet-oauth2-client-client-authentication.html" class="sidebar-link">Client Authentication Support</a></li><li><a href="/en/spring-security/servlet-oauth2-client-authorized-clients.html" class="sidebar-link">Authorized Client Features</a></li><li><a href="/en/spring-security/servlet-oauth2-resource-server.html" class="sidebar-link">OAuth 2.0 Resource Server</a></li><li><a href="/en/spring-security/servlet-oauth2-resource-server-jwt.html" class="sidebar-link">OAuth 2.0 Resource Server JWT</a></li><li><a href="/en/spring-security/servlet-oauth2-resource-server-opaque-token.html" class="sidebar-link">OAuth 2.0 Resource Server Opaque Token</a></li><li><a href="/en/spring-security/servlet-oauth2-resource-server-multitenancy.html" class="sidebar-link">OAuth 2.0 Resource Server Multitenancy</a></li><li><a href="/en/spring-security/servlet-oauth2-resource-server-bearer-tokens.html" class="sidebar-link">OAuth 2.0 Bearer Tokens</a></li><li><a href="/en/spring-security/servlet-saml2.html" class="sidebar-link">SAML2</a></li><li><a href="/en/spring-security/servlet-saml2-login.html" class="sidebar-link">SAML 2.0 Login</a></li><li><a href="/en/spring-security/servlet-saml2-login-overview.html" class="sidebar-link">SAML 2.0 Login Overview</a></li><li><a href="/en/spring-security/servlet-saml2-login-authentication-requests.html" class="sidebar-link">Producing &lt;saml2:AuthnRequest&gt;s</a></li><li><a href="/en/spring-security/servlet-saml2-login-authentication.html" class="sidebar-link">Authenticating &lt;saml2:Response&gt;s</a></li><li><a href="/en/spring-security/servlet-saml2-logout.html" class="sidebar-link">Performing Single Logout</a></li><li><a href="/en/spring-security/servlet-saml2-metadata.html" class="sidebar-link">Producing &lt;saml2:SPSSODescriptor&gt; Metadata</a></li><li><a href="/en/spring-security/servlet-exploits.html" class="sidebar-link">Protection Against Exploits</a></li><li><a href="/en/spring-security/servlet-exploits-csrf.html" class="sidebar-link">Cross Site Request Forgery (CSRF) for Servlet Environments</a></li><li><a href="/en/spring-security/servlet-exploits-headers.html" class="sidebar-link">Security HTTP Response Headers</a></li><li><a href="/en/spring-security/servlet-exploits-http.html" class="sidebar-link">HTTP</a></li><li><a href="/en/spring-security/servlet-exploits-firewall.html" class="sidebar-link">HttpFirewall</a></li><li><a href="/en/spring-security/servlet-integrations.html" class="sidebar-link">Integrations</a></li><li><a href="/en/spring-security/servlet-integrations-concurrency.html" class="sidebar-link">Concurrency Support</a></li><li><a href="/en/spring-security/servlet-integrations-jackson.html" class="sidebar-link">Jackson Support</a></li><li><a href="/en/spring-security/servlet-integrations-localization.html" class="sidebar-link">Localization</a></li><li><a href="/en/spring-security/servlet-integrations-servlet-api.html" class="sidebar-link">Servlet API integration</a></li><li><a href="/en/spring-security/servlet-integrations-data.html" class="sidebar-link">Spring Data Integration</a></li><li><a href="/en/spring-security/servlet-integrations-mvc.html" class="sidebar-link">Spring MVC Integration</a></li><li><a href="/en/spring-security/servlet-integrations-websocket.html" class="sidebar-link">WebSocket Security</a></li><li><a href="/en/spring-security/servlet-integrations-cors.html" class="sidebar-link">CORS</a></li><li><a href="/en/spring-security/servlet-integrations-jsp-taglibs.html" class="sidebar-link">JSP Tag Libraries</a></li><li><a href="/en/spring-security/servlet-configuration-java.html" class="sidebar-link">Java Configuration</a></li><li><a href="/en/spring-security/servlet-configuration-kotlin.html" class="sidebar-link">Kotlin Configuration</a></li><li><a href="/en/spring-security/servlet-configuration-xml-namespace.html" class="sidebar-link">Security Namespace Configuration</a></li><li><a href="/en/spring-security/servlet-test.html" class="sidebar-link">Testing</a></li><li><a href="/en/spring-security/servlet-test-method.html" class="sidebar-link">Testing Method Security</a></li><li><a href="/en/spring-security/servlet-test-mockmvc.html" class="sidebar-link">Spring MVC Test Integration</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-setup.html" class="sidebar-link">Setting Up MockMvc and Spring Security</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-request-post-processors.html" class="sidebar-link">SecurityMockMvcRequestPostProcessors</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-authentication.html" class="sidebar-link">Running a Test as a User in Spring MVC Test</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-csrf.html" class="sidebar-link">Testing with CSRF Protection</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-form-login.html" class="sidebar-link">Testing Form Based Authentication</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-http-basic.html" class="sidebar-link">Testing HTTP Basic Authentication</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-oauth2.html" class="sidebar-link">Testing OAuth 2.0</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-logout.html" class="sidebar-link">Testing Logout</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-request-builders.html" class="sidebar-link">SecurityMockMvcRequestBuilders</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-result-matchers.html" class="sidebar-link">SecurityMockMvcResultMatchers</a></li><li><a href="/en/spring-security/servlet-test-mockmvc-result-handlers.html" class="sidebar-link">SecurityMockMvcResultHandlers</a></li><li><a href="/en/spring-security/servlet-appendix.html" class="sidebar-link">Appendix</a></li><li><a href="/en/spring-security/servlet-appendix-database-schema.html" class="sidebar-link">Security Database Schema</a></li><li><a href="/en/spring-security/servlet-appendix-namespace.html" class="sidebar-link">The Security Namespace</a></li><li><a href="/en/spring-security/servlet-appendix-namespace-authentication-manager.html" class="sidebar-link">Authentication Services</a></li><li><a href="/en/spring-security/servlet-appendix-namespace-http.html" class="sidebar-link">Web Application Security</a></li><li><a href="/en/spring-security/servlet-appendix-namespace-method-security.html" class="sidebar-link">Method Security</a></li><li><a href="/en/spring-security/servlet-appendix-namespace-ldap.html" class="sidebar-link">LDAP Namespace Options</a></li><li><a href="/en/spring-security/servlet-appendix-namespace-websocket.html" class="sidebar-link">WebSocket Security</a></li><li><a href="/en/spring-security/servlet-appendix-faq.html" class="sidebar-link">Spring Security FAQ</a></li><li><a href="/en/spring-security/reactive.html" class="sidebar-link">Reactive Applications</a></li><li><a href="/en/spring-security/reactive-getting-started.html" class="sidebar-link">Getting Started with WebFlux Applications</a></li><li><a href="/en/spring-security/reactive-authentication-x509.html" class="sidebar-link">Reactive X.509 Authentication</a></li><li><a href="/en/spring-security/reactive-authentication-logout.html" class="sidebar-link">Logout</a></li><li><a href="/en/spring-security/reactive-authorization-authorize-http-requests.html" class="sidebar-link">Authorize ServerHttpRequest</a></li><li><a href="/en/spring-security/reactive-authorization-method.html" class="sidebar-link">EnableReactiveMethodSecurity</a></li><li><a href="/en/spring-security/reactive-oauth2.html" class="sidebar-link">OAuth2 WebFlux</a></li><li><a href="/en/spring-security/reactive-oauth2-login.html" class="sidebar-link">OAuth 2.0 Login</a></li><li><a href="/en/spring-security/reactive-oauth2-login-core.html" class="sidebar-link">Core Configuration</a></li><li><a href="/en/spring-security/reactive-oauth2-login-advanced.html" class="sidebar-link">Advanced Configuration</a></li><li><a href="/en/spring-security/reactive-oauth2-client.html" class="sidebar-link">OAuth 2.0 Client</a></li><li><a href="/en/spring-security/reactive-oauth2-client-core.html" class="sidebar-link">Core Interfaces / Classes</a></li><li><a href="/en/spring-security/reactive-oauth2-client-authorization-grants.html" class="sidebar-link">Authorization Grant Support</a></li><li><a href="/en/spring-security/reactive-oauth2-client-client-authentication.html" class="sidebar-link">Client Authentication Support</a></li><li><a href="/en/spring-security/reactive-oauth2-client-authorized-clients.html" class="sidebar-link">Authorized Clients</a></li><li><a href="/en/spring-security/reactive-oauth2-resource-server.html" class="sidebar-link">OAuth 2.0 Resource Server</a></li><li><a href="/en/spring-security/reactive-oauth2-resource-server-jwt.html" class="sidebar-link">OAuth 2.0 Resource Server JWT</a></li><li><a href="/en/spring-security/reactive-oauth2-resource-server-opaque-token.html" class="sidebar-link">OAuth 2.0 Resource Server Opaque Token</a></li><li><a href="/en/spring-security/reactive-oauth2-resource-server-multitenancy.html" class="sidebar-link">OAuth 2.0 Resource Server Multitenancy</a></li><li><a href="/en/spring-security/reactive-oauth2-resource-server-bearer-tokens.html" class="sidebar-link">OAuth 2.0 Resource Server Bearer Tokens</a></li><li><a href="/en/spring-security/reactive-exploits.html" class="sidebar-link">Protection Against Exploits</a></li><li><a href="/en/spring-security/reactive-exploits-csrf.html" class="sidebar-link">Cross Site Request Forgery (CSRF) for WebFlux Environments</a></li><li><a href="/en/spring-security/reactive-exploits-headers.html" class="sidebar-link">Security HTTP Response Headers</a></li><li><a href="/en/spring-security/reactive-exploits-http.html" class="sidebar-link">HTTP</a></li><li><a href="/en/spring-security/reactive-integrations-cors.html" class="sidebar-link">CORS</a></li><li><a href="/en/spring-security/reactive-integrations-rsocket.html" class="sidebar-link">RSocket Security</a></li><li><a href="/en/spring-security/reactive-test.html" class="sidebar-link">Reactive Test Support</a></li><li><a href="/en/spring-security/reactive-test-method.html" class="sidebar-link">Testing Method Security</a></li><li><a href="/en/spring-security/reactive-test-web.html" class="sidebar-link">Testing Web Security</a></li><li><a href="/en/spring-security/reactive-test-web-setup.html" class="sidebar-link">WebTestClient Security Setup</a></li><li><a href="/en/spring-security/reactive-test-web-authentication.html" class="sidebar-link">Testing Authentication</a></li><li><a href="/en/spring-security/reactive-test-web-csrf.html" class="sidebar-link">Testing with CSRF</a></li><li><a href="/en/spring-security/reactive-test-web-oauth2.html" class="sidebar-link">Testing OAuth 2.0</a></li><li><a href="/en/spring-security/reactive-configuration-webflux.html" class="sidebar-link">WebFlux Security</a></li></ul></section></li></ul> </aside> <main class="page"> <div class="theme-default-content content__default"><h1 id="cross-site-request-forgery-csrf"><a href="#cross-site-request-forgery-csrf" class="header-anchor">#</a> Cross Site Request Forgery (CSRF)</h1> <p>Spring provides comprehensive support for protecting against <a href="https://en.wikipedia.org/wiki/Cross-site_request_forgery" target="_blank" rel="noopener noreferrer">Cross Site Request Forgery (CSRF)<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a> attacks.
In the following sections we will explore:</p> <ul><li><p><a href="#csrf-explained">What is a CSRF Attack?</a></p></li> <li><p><a href="#csrf-protection">Protecting Against CSRF Attacks</a></p></li> <li><p><a href="#csrf-considerations">CSRF Considerations</a></p></li></ul> <table><thead><tr><th></th> <th>This portion of the documentation discusses the general topic of CSRF protection.<br>Refer to the relevant sections for specific information on CSRF protection for <a href="/servlet/exploits/csrf.html#servlet-csrf">servlet</a> and <a href="/reactive/exploits/csrf.html#webflux-csrf">WebFlux</a> based applications.</th></tr></thead> <tbody></tbody></table> <h2 id="what-is-a-csrf-attack"><a href="#what-is-a-csrf-attack" class="header-anchor">#</a> What is a CSRF Attack?</h2> <p>The best way to understand a CSRF attack is by taking a look at a concrete example.</p> <p>Assume that your bank’s website provides a form that allows transferring money from the currently logged in user to another bank account.
For example, the transfer form might look like:</p> <p>Example 1. Transfer form</p> <div class="language- extra-class"><pre class="language-text"><code>&lt;form method=&quot;post&quot;
	action=&quot;/transfer&quot;&gt;
&lt;input type=&quot;text&quot;
	name=&quot;amount&quot;/&gt;
&lt;input type=&quot;text&quot;
	name=&quot;routingNumber&quot;/&gt;
&lt;input type=&quot;text&quot;
	name=&quot;account&quot;/&gt;
&lt;input type=&quot;submit&quot;
	value=&quot;Transfer&quot;/&gt;
&lt;/form&gt;
</code></pre></div><p>The corresponding HTTP request might look like:</p> <p>Example 2. Transfer HTTP request</p> <div class="language- extra-class"><pre class="language-text"><code>POST /transfer HTTP/1.1
Host: bank.example.com
Cookie: JSESSIONID=randomid
Content-Type: application/x-www-form-urlencoded

amount=100.00&amp;routingNumber=1234&amp;account=9876
</code></pre></div><p>Now pretend you authenticate to your bank’s website and then, without logging out, visit an evil website.
The evil website contains an HTML page with the following form:</p> <p>Example 3. Evil transfer form</p> <div class="language- extra-class"><pre class="language-text"><code>&lt;form method=&quot;post&quot;
	action=&quot;https://bank.example.com/transfer&quot;&gt;
&lt;input type=&quot;hidden&quot;
	name=&quot;amount&quot;
	value=&quot;100.00&quot;/&gt;
&lt;input type=&quot;hidden&quot;
	name=&quot;routingNumber&quot;
	value=&quot;evilsRoutingNumber&quot;/&gt;
&lt;input type=&quot;hidden&quot;
	name=&quot;account&quot;
	value=&quot;evilsAccountNumber&quot;/&gt;
&lt;input type=&quot;submit&quot;
	value=&quot;Win Money!&quot;/&gt;
&lt;/form&gt;
</code></pre></div><p>You like to win money, so you click on the submit button.
In the process, you have unintentionally transferred $100 to a malicious user.
This happens because, while the evil website cannot see your cookies, the cookies associated with your bank are still sent along with the request.</p> <p>Worst yet, this whole process could have been automated using JavaScript.
This means you didn’t even need to click on the button.
Furthermore, it could just as easily happen when visiting an honest site that is a victim of a <a href="https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)" target="_blank" rel="noopener noreferrer">XSS attack<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a>.
So how do we protect our users from such attacks?</p> <h2 id="protecting-against-csrf-attacks"><a href="#protecting-against-csrf-attacks" class="header-anchor">#</a> Protecting Against CSRF Attacks</h2> <p>The reason that a CSRF attack is possible is that the HTTP request from the victim’s website and the request from the attacker’s website are exactly the same.
This means there is no way to reject requests coming from the evil website and allow requests coming from the bank’s website.
To protect against CSRF attacks we need to ensure there is something in the request that the evil site is unable to provide so we can differentiate the two requests.</p> <p>Spring provides two mechanisms to protect against CSRF attacks:</p> <ul><li><p>The <a href="#csrf-protection-stp">Synchronizer Token Pattern</a></p></li> <li><p>Specifying the <a href="#csrf-protection-ssa">SameSite Attribute</a> on your session cookie</p></li></ul> <table><thead><tr><th></th> <th>Both protections require that <a href="#csrf-protection-idempotent">Safe Methods Must be Idempotent</a></th></tr></thead> <tbody></tbody></table> <h3 id="safe-methods-must-be-idempotent"><a href="#safe-methods-must-be-idempotent" class="header-anchor">#</a> Safe Methods Must be Idempotent</h3> <p>In order for <a href="#csrf-protection">either protection</a> against CSRF to work, the application must ensure that <a href="https://tools.ietf.org/html/rfc7231#section-4.2.1" target="_blank" rel="noopener noreferrer">&quot;safe&quot; HTTP methods are idempotent<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a>.
This means that requests with the HTTP method <code>GET</code>, <code>HEAD</code>, <code>OPTIONS</code>, and <code>TRACE</code> should not change the state of the application.</p> <h3 id="synchronizer-token-pattern"><a href="#synchronizer-token-pattern" class="header-anchor">#</a> Synchronizer Token Pattern</h3> <p>The predominant and most comprehensive way to protect against CSRF attacks is to use the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#synchronizer-token-pattern" target="_blank" rel="noopener noreferrer">Synchronizer Token Pattern<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a>.
This solution is to ensure that each HTTP request requires, in addition to our session cookie, a secure random generated value called a CSRF token must be present in the HTTP request.</p> <p>When an HTTP request is submitted, the server must look up the expected CSRF token and compare it against the actual CSRF token in the HTTP request.
If the values do not match, the HTTP request should be rejected.</p> <p>The key to this working is that the actual CSRF token should be in a part of the HTTP request that is not automatically included by the browser.
For example, requiring the actual CSRF token in an HTTP parameter or an HTTP header will protect against CSRF attacks.
Requiring the actual CSRF token in a cookie does not work because cookies are automatically included in the HTTP request by the browser.</p> <p>We can relax the expectations to only require the actual CSRF token for each HTTP request that updates state of the application.
For that to work, our application must ensure that <a href="#csrf-protection-idempotent">safe HTTP methods are idempotent</a>.
This improves usability since we want to allow linking to our website using links from external sites.
Additionally, we do not want to include the random token in HTTP GET as this can cause the tokens to be leaked.</p> <p>Let’s take a look at how <a href="#csrf-explained">our example</a> would change when using the Synchronizer Token Pattern.
Assume the actual CSRF token is required to be in an HTTP parameter named <code>_csrf</code>.
Our application’s transfer form would look like:</p> <p>Example 4. Synchronizer Token Form</p> <div class="language- extra-class"><pre class="language-text"><code>&lt;form method=&quot;post&quot;
	action=&quot;/transfer&quot;&gt;
&lt;input type=&quot;hidden&quot;
	name=&quot;_csrf&quot;
	value=&quot;4bfd1575-3ad1-4d21-96c7-4ef2d9f86721&quot;/&gt;
&lt;input type=&quot;text&quot;
	name=&quot;amount&quot;/&gt;
&lt;input type=&quot;text&quot;
	name=&quot;routingNumber&quot;/&gt;
&lt;input type=&quot;hidden&quot;
	name=&quot;account&quot;/&gt;
&lt;input type=&quot;submit&quot;
	value=&quot;Transfer&quot;/&gt;
&lt;/form&gt;
</code></pre></div><p>The form now contains a hidden input with the value of the CSRF token.
External sites cannot read the CSRF token since the same origin policy ensures the evil site cannot read the response.</p> <p>The corresponding HTTP request to transfer money would look like this:</p> <p>Example 5. Synchronizer Token request</p> <div class="language- extra-class"><pre class="language-text"><code>POST /transfer HTTP/1.1
Host: bank.example.com
Cookie: JSESSIONID=randomid
Content-Type: application/x-www-form-urlencoded

amount=100.00&amp;routingNumber=1234&amp;account=9876&amp;_csrf=4bfd1575-3ad1-4d21-96c7-4ef2d9f86721
</code></pre></div><p>You will notice that the HTTP request now contains the <code>_csrf</code> parameter with a secure random value.
The evil website will not be able to provide the correct value for the <code>_csrf</code> parameter (which must be explicitly provided on the evil website) and the transfer will fail when the server compares the actual CSRF token to the expected CSRF token.</p> <h3 id="samesite-attribute"><a href="#samesite-attribute" class="header-anchor">#</a> SameSite Attribute</h3> <p>An emerging way to protect against <a href="#csrf">CSRF Attacks</a> is to specify the <a href="https://tools.ietf.org/html/draft-west-first-party-cookies" target="_blank" rel="noopener noreferrer">SameSite Attribute<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a> on cookies.
A server can specify the <code>SameSite</code> attribute when setting a cookie to indicate that the cookie should not be sent when coming from external sites.</p> <table><thead><tr><th></th> <th>Spring Security does not directly control the creation of the session cookie, so it does not provide support for the SameSite attribute.<a href="https://spring.io/projects/spring-session" target="_blank" rel="noopener noreferrer">Spring Session<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a> provides support for the <code>SameSite</code> attribute in servlet based applications.<br>Spring Framework’s <a href="https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/web/server/session/CookieWebSessionIdResolver.html" target="_blank" rel="noopener noreferrer">CookieWebSessionIdResolver<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a> provides out of the box support for the <code>SameSite</code> attribute in WebFlux based applications.</th></tr></thead> <tbody></tbody></table> <p>An example, HTTP response header with the <code>SameSite</code> attribute might look like:</p> <p>Example 6. SameSite HTTP response</p> <div class="language- extra-class"><pre class="language-text"><code>Set-Cookie: JSESSIONID=randomid; Domain=bank.example.com; Secure; HttpOnly; SameSite=Lax
</code></pre></div><p>Valid values for the <code>SameSite</code> attribute are:</p> <ul><li><p><code>Strict</code> - when specified any request coming from the <a href="https://tools.ietf.org/html/draft-west-first-party-cookies-07#section-2.1" target="_blank" rel="noopener noreferrer">same-site<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a> will include the cookie.
Otherwise, the cookie will not be included in the HTTP request.</p></li> <li><p><code>Lax</code> - when specified cookies will be sent when coming from the <a href="https://tools.ietf.org/html/draft-west-first-party-cookies-07#section-2.1" target="_blank" rel="noopener noreferrer">same-site<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a> or when the request comes from top-level navigations and the <a href="#csrf-protection-idempotent">method is idempotent</a>.
Otherwise, the cookie will not be included in the HTTP request.</p></li></ul> <p>Let’s take a look at how <a href="#csrf-explained">our example</a> could be protected using the <code>SameSite</code> attribute.
The bank application can protect against CSRF by specifying the <code>SameSite</code> attribute on the session cookie.</p> <p>With the <code>SameSite</code> attribute set on our session cookie, the browser will continue to send the <code>JSESSIONID</code> cookie with requests coming from the banking website.
However, the browser will no longer send the <code>JSESSIONID</code> cookie with a transfer request coming from the evil website.
Since the session is no longer present in the transfer request coming from the evil website, the application is protected from the CSRF attack.</p> <p>There are some important <a href="https://tools.ietf.org/html/draft-west-first-party-cookies-07#section-5" target="_blank" rel="noopener noreferrer">considerations<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a> that one should be aware about when using <code>SameSite</code> attribute to protect against CSRF attacks.</p> <p>Setting the <code>SameSite</code> attribute to <code>Strict</code> provides a stronger defense but can confuse users.
Consider a user that stays logged into a social media site hosted at <a href="https://social.example.com" target="_blank" rel="noopener noreferrer">https://social.example.com<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a>.
The user receives an email at <a href="https://email.example.org" target="_blank" rel="noopener noreferrer">https://email.example.org<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a> that includes a link to the social media site.
If the user clicks on the link, they would rightfully expect to be authenticated to the social media site.
However, if the <code>SameSite</code> attribute is <code>Strict</code> the cookie would not be sent and so the user would not be authenticated.</p> <table><thead><tr><th></th> <th>We could improve the protection and usability of <code>SameSite</code> protection against CSRF attacks by implementing <a href="https://github.com/spring-projects/spring-security/issues/7537" target="_blank" rel="noopener noreferrer">gh-7537<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a>.</th></tr></thead> <tbody></tbody></table> <p>Another obvious consideration is that in order for the <code>SameSite</code> attribute to protect users, the browser must support the <code>SameSite</code> attribute.
Most modern browsers do <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/headers/Set-Cookie#Browser_compatibility" target="_blank" rel="noopener noreferrer">support the SameSite attribute<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a>.
However, older browsers that are still in use may not.</p> <p>For this reason, it is generally recommended to use the <code>SameSite</code> attribute as a defense in depth rather than the sole protection against CSRF attacks.</p> <h2 id="when-to-use-csrf-protection"><a href="#when-to-use-csrf-protection" class="header-anchor">#</a> When to use CSRF protection</h2> <p>When should you use CSRF protection?
Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users.
If you are only creating a service that is used by non-browser clients, you will likely want to disable CSRF protection.</p> <h3 id="csrf-protection-and-json"><a href="#csrf-protection-and-json" class="header-anchor">#</a> CSRF protection and JSON</h3> <p>A common question is &quot;do I need to protect JSON requests made by javascript?&quot;
The short answer is, it depends.
However, you must be very careful as there are CSRF exploits that can impact JSON requests.
For example, a malicious user can create a <a href="http://blog.opensecurityresearch.com/2012/02/json-csrf-with-parameter-padding.html" target="_blank" rel="noopener noreferrer">CSRF with JSON using the following form<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a>:</p> <p>Example 7. CSRF with JSON form</p> <div class="language- extra-class"><pre class="language-text"><code>&lt;form action=&quot;https://bank.example.com/transfer&quot; method=&quot;post&quot; enctype=&quot;text/plain&quot;&gt;
	&lt;input name='{&quot;amount&quot;:100,&quot;routingNumber&quot;:&quot;evilsRoutingNumber&quot;,&quot;account&quot;:&quot;evilsAccountNumber&quot;, &quot;ignore_me&quot;:&quot;' value='test&quot;}' type='hidden'&gt;
	&lt;input type=&quot;submit&quot;
		value=&quot;Win Money!&quot;/&gt;
&lt;/form&gt;
</code></pre></div><p>This will produce the following JSON structure</p> <p>Example 8. CSRF with JSON request</p> <div class="language- extra-class"><pre class="language-text"><code>{ &quot;amount&quot;: 100,
&quot;routingNumber&quot;: &quot;evilsRoutingNumber&quot;,
&quot;account&quot;: &quot;evilsAccountNumber&quot;,
&quot;ignore_me&quot;: &quot;=test&quot;
}
</code></pre></div><p>If an application were not validating the Content-Type, then it would be exposed to this exploit.
Depending on the setup, a Spring MVC application that validates the Content-Type could still be exploited by updating the URL suffix to end with <code>.json</code> as shown below:</p> <p>Example 9. CSRF with JSON Spring MVC form</p> <div class="language- extra-class"><pre class="language-text"><code>&lt;form action=&quot;https://bank.example.com/transfer.json&quot; method=&quot;post&quot; enctype=&quot;text/plain&quot;&gt;
	&lt;input name='{&quot;amount&quot;:100,&quot;routingNumber&quot;:&quot;evilsRoutingNumber&quot;,&quot;account&quot;:&quot;evilsAccountNumber&quot;, &quot;ignore_me&quot;:&quot;' value='test&quot;}' type='hidden'&gt;
	&lt;input type=&quot;submit&quot;
		value=&quot;Win Money!&quot;/&gt;
&lt;/form&gt;
</code></pre></div><h3 id="csrf-and-stateless-browser-applications"><a href="#csrf-and-stateless-browser-applications" class="header-anchor">#</a> CSRF and Stateless Browser Applications</h3> <p>What if my application is stateless?
That doesn’t necessarily mean you are protected.
In fact, if a user does not need to perform any actions in the web browser for a given request, they are likely still vulnerable to CSRF attacks.</p> <p>For example, consider an application that uses a custom cookie that contains all the state within it for authentication instead of the JSESSIONID.
When the CSRF attack is made the custom cookie will be sent with the request in the same manner that the JSESSIONID cookie was sent in our previous example.
This application will be vulnerable to CSRF attacks.</p> <p>Applications that use basic authentication are also vulnerable to CSRF attacks.
The application is vulnerable since the browser will automatically include the username and password in any requests in the same manner that the JSESSIONID cookie was sent in our previous example.</p> <h2 id="csrf-considerations"><a href="#csrf-considerations" class="header-anchor">#</a> CSRF Considerations</h2> <p>There are a few special considerations to consider when implementing protection against CSRF attacks.</p> <h3 id="logging-in"><a href="#logging-in" class="header-anchor">#</a> Logging In</h3> <p>In order to protect against <a href="https://en.wikipedia.org/wiki/Cross-site_request_forgery#Forging_login_requests" target="_blank" rel="noopener noreferrer">forging log in requests<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a> the log in HTTP request should be protected against CSRF attacks.
Protecting against forging log in requests is necessary so that a malicious user cannot read a victim’s sensitive information.
The attack is performed as follows:</p> <ul><li><p>A malicious user performs a CSRF log in using the malicious user’s credentials.
The victim is now authenticated as the malicious user.</p></li> <li><p>The malicious user then tricks the victim to visit the compromised website and enter sensitive information</p></li> <li><p>The information is associated to the malicious user’s account so the malicious user can log in with their own credentials and view the vicitim’s sensitive information</p></li></ul> <p>A possible complication to ensuring log in HTTP requests are protected against CSRF attacks is that the user might experience a session timeout that causes the request to be rejected.
A session timeout is surprising to users who do not expect to need to have a session in order to log in.
For more information refer to <a href="#csrf-considerations-timeouts">CSRF and Session Timeouts</a>.</p> <h3 id="logging-out"><a href="#logging-out" class="header-anchor">#</a> Logging Out</h3> <p>In order to protect against forging log out requests, the log out HTTP request should be protected against CSRF attacks.
Protecting against forging log out requests is necessary so a malicious user cannot read a victim’s sensitive information.
For details on the attack refer to <a href="https://labs.detectify.com/2017/03/15/loginlogout-csrf-time-to-reconsider/" target="_blank" rel="noopener noreferrer">this blog post<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a>.</p> <p>A possible complication to ensuring log out HTTP requests are protected against CSRF attacks is that the user might experience a session timeout that causes the request to be rejected.
A session timeout is surprising to users who do not expect to need to have a session in order to log out.
For more information refer to <a href="#csrf-considerations-timeouts">CSRF and Session Timeouts</a>.</p> <h3 id="csrf-and-session-timeouts"><a href="#csrf-and-session-timeouts" class="header-anchor">#</a> CSRF and Session Timeouts</h3> <p>More often than not, the expected CSRF token is stored in the session.
This means that as soon as the session expires the server will not find an expected CSRF token and reject the HTTP request.
There are a number of options to solve timeouts each of which come with trade offs.</p> <ul><li><p>The best way to mitigate the timeout is by using JavaScript to request a CSRF token on form submission.
The form is then updated with the CSRF token and submitted.</p></li> <li><p>Another option is to have some JavaScript that lets the user know their session is about to expire.
The user can click a button to continue and refresh the session.</p></li> <li><p>Finally, the expected CSRF token could be stored in a cookie.
This allows the expected CSRF token to outlive the session.</p> <p>One might ask why the expected CSRF token isn’t stored in a cookie by default.
This is because there are known exploits in which headers (for example, to specify the cookies) can be set by another domain.
This is the same reason Ruby on Rails <a href="https://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails/" target="_blank" rel="noopener noreferrer">no longer skips CSRF checks when the header X-Requested-With is present<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a>.
See <a href="https://web.archive.org/web/20210221120355/https://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-February/007533.html" target="_blank" rel="noopener noreferrer">this webappsec.org thread<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a> for details on how to perform the exploit.
Another disadvantage is that by removing the state (that is, the timeout), you lose the ability to forcibly invalidate the token if it is compromised.</p></li></ul> <h3 id=""><a href="#" class="header-anchor">#</a></h3> <p>Protecting multipart requests (file uploads) from CSRF attacks causes a <a href="https://en.wikipedia.org/wiki/Chicken_or_the_egg" target="_blank" rel="noopener noreferrer">chicken and the egg<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a> problem.
In order to prevent a CSRF attack from occurring, the body of the HTTP request must be read to obtain actual CSRF token.
However, reading the body means that the file will be uploaded which means an external site can upload a file.</p> <p>There are two options to using CSRF protection with multipart/form-data.
Each option has its trade-offs.</p> <ul><li><p><a href="#csrf-considerations-multipart-body">Place CSRF Token in the Body</a></p></li> <li><p><a href="#csrf-considerations-multipart-url">Place CSRF Token in the URL</a></p></li></ul> <table><thead><tr><th></th> <th>Before you integrate Spring Security’s CSRF protection with multipart file upload, ensure that you can upload without the CSRF protection first.<br>More information about using multipart forms with Spring can be found within the <a href="https://docs.spring.io/spring/docs/5.2.x/spring-framework-reference/web.html#mvc-multipart" target="_blank" rel="noopener noreferrer">1.1.11. Multipart Resolver<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a> section of the Spring reference and the <a href="https://docs.spring.io/spring/docs/5.2.x/javadoc-api/org/springframework/web/multipart/support/MultipartFilter.html" target="_blank" rel="noopener noreferrer">MultipartFilter javadoc<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a>.</th></tr></thead> <tbody></tbody></table> <h4 id="place-csrf-token-in-the-body"><a href="#place-csrf-token-in-the-body" class="header-anchor">#</a> Place CSRF Token in the Body</h4> <p>The first option is to include the actual CSRF token in the body of the request.
By placing the CSRF token in the body, the body will be read before authorization is performed.
This means that anyone can place temporary files on your server.
However, only authorized users will be able to submit a file that is processed by your application.
In general, this is the recommended approach because the temporary file upload should have a negligible impact on most servers.</p> <h4 id="include-csrf-token-in-url"><a href="#include-csrf-token-in-url" class="header-anchor">#</a> Include CSRF Token in URL</h4> <p>If allowing unauthorized users to upload temporary files is not acceptable, an alternative is to include the expected CSRF token as a query parameter in the action attribute of the form.
The disadvantage to this approach is that query parameters can be leaked.
More generally, it is considered best practice to place sensitive data within the body or headers to ensure it is not leaked.
Additional information can be found in <a href="https://www.w3.org/Protocols/rfc2616/rfc2616-sec15.html#sec15.1.3" target="_blank" rel="noopener noreferrer">RFC 2616 Section 15.1.3 Encoding Sensitive Information in URI’s<span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></a>.</p> <h4 id="hiddenhttpmethodfilter"><a href="#hiddenhttpmethodfilter" class="header-anchor">#</a> HiddenHttpMethodFilter</h4> <p>In some applications a form parameter can be used to override the HTTP method.
For example, the form below could be used to treat the HTTP method as a <code>delete</code> rather than a <code>post</code>.</p> <p>Example 10. CSRF Hidden HTTP Method Form</p> <div class="language- extra-class"><pre class="language-text"><code>&lt;form action=&quot;/process&quot;
	method=&quot;post&quot;&gt;
	&lt;!-- ... --&gt;
	&lt;input type=&quot;hidden&quot;
		name=&quot;_method&quot;
		value=&quot;delete&quot;/&gt;
&lt;/form&gt;
</code></pre></div><p>Overriding the HTTP method occurs in a filter.
That filter must be placed before Spring Security’s support.
Note that overriding only happens on a <code>post</code>, so this is actually unlikely to cause any real problems.
However, it is still best practice to ensure it is placed before Spring Security’s filters.</p></div> <footer class="page-edit"><div class="edit-link"><a href="https://gitcode.net/dev-cloud/spring-docs/-/blob/master/docs/en/spring-security/features-exploits-csrf.md" target="_blank" rel="noopener noreferrer">Edit this page on GitCode</a> <span><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg> <span class="sr-only">(opens new window)</span></span></div> <div class="last-updated"><span class="prefix">Last Updated:</span> <span class="time">Wed Mar 16 2022 18:27:04 GMT+0800</span></div></footer> <div class="page-nav"><p class="inner"><span class="prev">
      ←
      <a href="/en/spring-security/features-exploits.html" class="prev">
        Protection Against Exploits
      </a></span> <span class="next"><a href="/en/spring-security/features-exploits-headers.html">
        Security HTTP Response Headers
      </a>
      →
    </span></p></div> </main></div><div class="global-ui"></div></div>
    <script src="/assets/js/app.91a38a71.js" defer></script><script src="/assets/js/3.50918073.js" defer></script><script src="/assets/js/4.cd4c3ff4.js" defer></script><script src="/assets/js/168.e16111b9.js" defer></script>
  </body>
</html>