Selectively disable csrf by RequestMatcher

[jzheaux]

CsrfConfigurer can already be selectively disabled using ant patterns:

csrf().ignoringAntMatchers("/no-csrf/**")

Being able to ignore by a RequestMatcher would lend more power to the user as other parts of the request would now become available as well:

csrf().ignoringRequestMatchers(request -> request.getHeader("Authorization") != null)

[chrylis]

I came here to request this specific feature. Any chance of a backport to 4.3? (As far as I can tell, CsrfConfigurer should be able to expose an ignoringRequestMatchers there with no API difficulty.)

[jzheaux]

Probably not, @chrylis. There are no plans for a 4.3.x series of releases and the 4.2.x series is really just for bug fixes at this point.

You can do this by customizing the csrf filter outside of the DSL, though:

RequestMatcher myMatcher =
    new AndRequestMatcher(
        CsrfFilter.DEFAULT_CSRF_MATCHER, 
        new NegatedRequestMatcher(/* your logic */));
csrfFilter.setRequireCsrfProtectionMatcher(myMatcher);

And then either use addFilter:

CsrfFilter csrfFilter = new CsrfFilter(...);
// your customizations
http.addFilter(csrfFilter);

Or use withObjectPostProcessor:

http
    .withObjectPostProcessor(new ObjectPostProcessor<CsrfFilter>() {
        public CsrfFilter postProcess(CsrfFilter csrfFilter) {
            // your customizations
        }
    });

[chrylis]

My current approach has been to implement a custom matcher

.requireCsrfProtectionMatcher(new ExemptOAuthRequiresCsrfMatcher())

so it's working, but upgrading to 5 is not an option until authorization is implemented.

[rwinch]

so it's working, but upgrading to 5 is not an option until authorization is implemented.

Can you clarify what you mean? Is there something Spring Security 5 is missing that is preventing an updated?

[chrylis]

@rwinch The project in question is an OAuth2 authorization server.

[rwinch]

Yes. You are correct. You would need to use the old support for an authorization server at this point.