CODEWITHSUNDEEP
springspring-securitycsrf
martin samm
martin samm

Reputation: 137

Rest Services and CSRF

I have a number of services accessed by singe page apps. I want to enable CSRF across those apps, but if they each have their own CSRF Token Repository then i have an issue of different tokens for different apps, even though they share the same session.

Is there a shared CSRF Token Store implementation whereby services share a common token generation/validation mechanism?

Upvotes: 0

Views: 111

Answers (1)

Luke Bajada
Luke Bajada

Reputation: 1842

In Spring Security, the CSRF Token is stored in the session by default (see HttpSessionCsrfTokenRepository). Therefore if your apps are sharing the same session, they should be configured to share the CSRF Token as well.

Upvotes: 2

Related Questions