How can I configure Spring Security to enforce CSRF against both backend-to-backend calls and external integrations? Internal API calls and third-party requests are token-challenged. Below is an alternative implementation:
@Configuration
@EnableWebSecurity
public class CustomSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity httpSec) throws Exception {
httpSec.csrf()
.csrfTokenRepository(CustomCookieTokenRepository.withNonHttpOnlyFlag())
.requireCsrfProtectionMatcher(request -> {
Set<String> safeOps = new HashSet<>(Arrays.asList("GET", "HEAD", "OPTIONS"));
return !safeOps.contains(request.getMethod());
});
}
}
@RestController
public class VersionController {
@GetMapping("/version")
public String versionInfo() {
return "Version 1.0 running";
}
}
@RestController
public class SubmitController {
@PostMapping("/{id}/submit")
public String processSubmit(@PathVariable String id) {
return "Submission for: " + id;
}
}
@RestController
public class ChainController {
@PostMapping("/{id}/chain")
public String chainProcess(@PathVariable String id) {
RestTemplate template = new RestTemplate();
String target = "http://localhost:8080/api/" + id + "/submit";
try {
String reply = template.postForObject(target, null, String.class);
return "Chain successful: " + reply;
} catch (Exception e) {
return "Chain failed";
}
}
}