xml - spring security 4 csrf 通过 xml 禁用

Question

有没有办法通过 XML 配置在 spring security 中禁用 CSRF token ？我只看到 java 配置在线..可以基于 xml 的示例。使用 spring 框架 4.0

Answer 1

As of Spring Security 4.0, CSRF protection is enabled by default with XML configuration. If you would like to disable CSRF protection, the corresponding XML configuration can be seen below.

<http>
  <!-- ... -->
  <csrf disabled="true"/>
</http>

CSRF protection is enabled by default with Java configuration. If you would like to disable CSRF, the corresponding Java configuration can be seen below. Refer to the Javadoc of csrf() for additional customizations in how CSRF protection is configured.

@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {

@Override
protected void configure(HttpSecurity http) throws Exception {
  http
  .csrf().disable();
}
}

见下面的链接 http://docs.spring.io/spring-security/site/docs/4.0.x/reference/htmlsingle/#csrf-configure