Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| http | ||
| // REST API 기본 세팅 | ||
| .csrf(csrf -> csrf.disable()).cors(Customizer.withDefaults()) |
Check failure
Code scanning / CodeQL
Disabled Spring CSRF protection High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
How to, in general terms, fix the problem:
To fix this issue, CSRF protection should not be globally disabled as this weakens the security of the application. Instead, keep the CSRF protection enabled by removing the explicit .csrf(csrf -> csrf.disable()) line from the security configuration. If there are certain endpoints (such as stateless APIs or endpoints that never change state via browser requests) that genuinely need to bypass CSRF checks, those individual endpoints can be configured accordingly—but disabling it globally is risky.
Detailed recommendation for this file:
Edit the filterChain bean in SecurityConfig.java to remove .csrf(csrf -> csrf.disable()) from the security filter chain setup (line 53). This will restore Spring's default behavior of enabling CSRF protection. No additional imports/configuration changes are necessary unless the application exposes certain API endpoints that must be excluded from CSRF protection—in which case, use explicit csrf.ignoringRequestMatchers(...) instead of disabling CSRF globally.
Specific changes:
- In
src/main/java/opensource/bravest/global/config/SecurityConfig.java, remove or comment out.csrf(csrf -> csrf.disable())from the builder chain in thefilterChainmethod.
| @@ -50,7 +50,7 @@ | ||
|
|
||
| http | ||
| // REST API 기본 세팅 | ||
| .csrf(csrf -> csrf.disable()).cors(Customizer.withDefaults()) | ||
| .cors(Customizer.withDefaults()) | ||
| .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) | ||
| .httpBasic(basic -> basic.disable()).formLogin(form -> form.disable()) | ||
| .logout(lo -> lo.disable()).requestCache(cache -> cache.disable()) |
1 participant
No description provided.