CSRF — What It Is and Spring Security CSRF Protection
Fast recall
Quick revision
Core answer
X-CSRF-TOKEN header. CSRF only matters when authentication uses cookies — for stateless JWT APIs (token in Authorization header), csrf().disable() is correct because cross-origin JS cannot set arbitrary headers. Modern browsers add SameSite=Lax|Strict cookies as a layered defense.Whether the candidate understands the session-cookie dependency of CSRF and the correct trade-offs between enabling/disabling CSRF protection.
Disabling CSRF in Spring Security for all applications without understanding that it's only safe to disable for truly stateless APIs.
Explain the Synchronizer Token Pattern vs Double Submit Cookie pattern, and why SameSite=Strict cookie attribute is a modern mitigation.
Interview-ready guide
Interview answer
How the attack works
- User logged into
bank.comwith session cookie - Attacker page
evil.comcontains - User visits
evil.com; browser submits form including the bank cookie - Bank sees a valid session cookie and processes the transfer
Spring Security's defense — Synchronizer Token Pattern
- Server generates a CSRF token per session, embeds in forms as hidden field
- POST/PUT/DELETE — Spring validates submitted token matches session token
evil.comcan't read the bank's CSRF token (same-origin policy) — forged form lacks it
For SPAs
CookieCsrfTokenRepository.withHttpOnlyFalse()- Token written to cookie that SPA JS can read
- SPA sends
X-XSRF-TOKENheader on every mutating request
When to disable
- Stateless JWT API: no session cookie -> no CSRF vector
http.csrf().disable()is safe and correct- Don't blindly copy this into session-based apps
Modern simplification
SameSite=Lax(browser default) blocks cross-site POST cookiesSameSite=Strictblocks all cross-site cookie attachmentserver.servlet.session.cookie.same-site=lax- Combine with token for defense in depth
Hybrid apps
- Two
SecurityFilterChainbeans /api/**stateless + CSRF disabled- Web UI session + CSRF enabled
Don't forget
- Login CSRF — pre-auth token still needed for login form
- OAuth2 redirect callback uses
stateparameter, not CSRF token - Multipart uploads — token in form field, not header
CSRF — What It Is and Spring Security CSRF Protection
Direct Answer
Cross-Site Request Forgery (CSRF) tricks an authenticated user's browser into making an unintended state-changing request, exploiting the fact that browsers automatically attach cookies. Spring Security defaults to the Synchronizer Token Pattern: a per-session token that must accompany every state-changing request as a hidden form field or X-CSRF-TOKEN header. CSRF only matters when authentication uses cookies — for stateless JWT APIs (token in Authorization header), csrf().disable() is correct because cross-origin JS cannot set arbitrary headers. Modern browsers add SameSite=Lax|Strict cookies as a layered defense.
Common Mistakes & Pitfalls
Disabling CSRF in Spring Security for all applications without understanding that it's only safe to disable for truly stateless APIs.
Check your understanding
Answer these without looking back at the article.
- Why is CSRF not a concern for GET requests?
- If you store a JWT in a cookie instead of localStorage, do you need CSRF protection?
- How does the SameSite cookie attribute relate to CSRF protection?
- How do you protect login and logout endpoints from CSRF?
Related interview prep categories
2Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.