How to handle CSRF protection with Spring RESTful web services?

Question

I have a Spring web application with CSRF protection enabled. I can access the RESTful service through AJAX calls, but when I access the service with other applications like httpurlconnection, I get error 401 (CSRF token is null).

I understand that to access the RESTful service I need to pass a token in the request header, but how can I get the CSRF token?

Answer 1

You can create a mapping in Spring MVC that receives the CSRF token:

@RequestMapping(value="/csrf-token", method=RequestMethod.GET) public @ResponseBody String getCsrfToken(HttpServletRequest request) { CsrfToken token = (CsrfToken)request.getAttribute(CsrfToken.class.getName()); return token.getToken(); }