CODEWITHSUNDEEP
springcsrf
Killer Beast
Killer Beast

Reputation: 509

Spring Web Security Config - Ignore CSRF Validation for either or

I have certain conditions to ignore csrf validations but I am not sure how to put this in config. Following are my conditions to ignore the validation:

Or

Here is the config I have now:

security.csrf().ignoringRequestMatchers(new RequestHeaderRequestMatcher("Authorization")).ignoringAntMatchers("/test").and();

But with this config, I guess it is treating it like an AND operation or something. How can I change this?

Upvotes: 1

Views: 323

Answers (1)

Marco Behler
Marco Behler

Reputation: 3724

Try the OrRequestMatcher.

security.csrf()
       .ignoringRequestMatchers(new OrRequestMatcher(new RequestHeaderRequestMatcher("Authorization"), new AntPathRequestMatcher("/test")));

Upvotes: 1

Related Questions