java - Spring 安全 : enable/disable CSRF by client type (browser/non-browser )

Question

Spring 安全文档 says :

"When you use CSRF protection? Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-browser clients, you will likely want to disable CSRF protection."

如果我的服务将被“浏览器”和“非浏览器”客户端(例如第三方外部服务)使用，Spring Security 是否提供了一种专门为某些类型的客户端禁用 CSRF 的方法？

Answer 1

我确信在 Spring Security XML 中有一种方法可以做到这一点，但是由于我使用的是 Java Config，所以这是我的解决方案。

 @Configuration
 @EnableWebSecurity
 public class SecurityConfig {

    @Configuration
    @Order(1)
    public static class SoapApiConfigurationAdapter extends WebSecurityConfigurerAdapter {
        protected void configure(HttpSecurity http) throws Exception {
            http
                .antMatcher("/soap/**")
                .csrf().disable()
                .httpBasic();
        }
    }


    @Configuration
    public static class WebApiConfigurationAdapter extends WebSecurityConfigurerAdapter {

        protected void configure(HttpSecurity http) throws Exception {
            http        
                .formLogin()
                    .loginProcessingUrl("/authentication")
                    .usernameParameter("j_username")
                    .passwordParameter("j_password").permitAll()
                    .and()
                .csrf().disable()

        }
     }
}