1
1
.
.
7
7
.
.
5
5
C
C
S
S
R
R
F
F
T
T
o
o
k
k
e
e
n
n
-
-
A
A
p
p
p
p
l
l
i
i
c
c
a
a
t
t
i
i
o
o
n
n
I
I
n
n
f
f
o
o
[
[
G
G
]
]
This tutorial shows how to enable CSRF Token for a Spring Boot Application.
Application Schema [Results]
Spring Boot Starters
GROUP
DEPENDENCY
DESCRIPTION
Web
Spring Web
Enables @Controller, @RequestMapping and Tomcat Server
Security
Spring Security
Enables Spring Security
Template Engines
Thyemeleaf
Enables Controller to return reference to HTML Page HelloForm.html
HelloForm
http://localhost:8080/HelloForm
Tomcat
helloForm()
Browser
MyController
http://localhost:8080/SayHello
sayHello()
P
P
r
r
o
o
c
c
e
e
d
d
u
u
r
r
e
e
Create Project: springboot_csrf_token_application (add Spring Boot Starters from the table)
Edit File: application.properties (add Role, User, Password)
Create Package: controllers (inside main package)
– Create Class: MyController.java (inside package controllers)
application.properties
# SECURITY
spring.security.user.name = myuser
spring.security.user.password = mypassword
spring.security.user.roles = USER
MyController.java
package com.ivoronline.springboot_csrf_token_application.controllers;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
@Controller
public class MyController {
@RequestMapping("/HelloForm")
public String helloForm() {
return "HelloForm";
}
@ResponseBody
@RequestMapping("/SayHello")
public String sayHello(@RequestParam String name) {
return "Hello " + name;
}
}
HelloForm.html
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<title> HELLO FORM </title>
<style type="text/css">
div { display:flex; flex-direction:column; align-items:center; border: solid 1pt; margin: 10pt 50pt;
background-color: aliceblue }
</style>
<div>
<h2> HELLO FORM </h2>
<form method="GET" action="SayHello">
<p> <input type="text" name="name" placeholder="Enter your name"/> </p>
<p> <input type="submit" name="submit" style="width:100%" /> </p>
<input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}"/>
</form>
</div>
<html>
R
R
e
e
s
s
u
u
l
l
t
t
s
s
http://localhost:8080/HelloForm
You get redirected to http://localhost:8080/login
– Username: myuser
– Password: mypassword
– Sign in
You get redirected back to http://localhost:8080/HelloForm
– (hidden _csrf Field gets populated by randomly generated CSRF Token 1e71147e-40e6-4653-956d-7346824089c3)
– Enter name: Bill
– Submit
You get redirected to http://localhost:8080/SayHello (with Form Input Parameters added to the URL)
– http://localhost:8080/SayHello?name=Bill&submit=Submit&_csrf=1e71147e-40e6-4653-956d-7346824089c3
– (hidden _csrf Field with CSRF Token is sent as part of HTTP Request _csrf=1e71147e-40e6-4653-956d-7346824089c3)
http://localhost:8080/login http://localhost:8080/HelloForm
View Source
http://localhost:8080/SayHello?name=Bill&submit=Submit&_csrf=1e71147e-40e6-4653-956d-7346824089c3
Application Structure
pom.xml
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-thymeleaf</artifactId>
</dependency>
</dependencies>
