enable CSRF support

[schneivo77]

Hi,

in springfox I could enable CSRF support with the method enableCsrfSupport of the SecurityConfigurationBuilder.
Is there a way to do this in springdoc too?

[bnasslahsen]

@schneivo77,

If you are using springdoc-openapi, you can use a requestInterceptor to capture and attach the latest xsrf token to requests programmatically via spring resource transformer:

Using springdoc-openapi, you can extend SwaggerIndexPageTransformer.
Technically, you will have to override the transform method and add your custom requestInterceptor.

This can be a functionality available out of the box for the next release.

• What is the name of your CSRF Header ? Are you relying on standard CSRF Headers ?
• What the names of your Cookies on the client side ?

[schneivo77]

@bnasslahsen

Thanks for your answer!

The 403 response I get from the server says:

Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-XSRF-TOKEN'.

I've got a cookie looking like this:

XSRF-TOKEN=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx;; Path=/; Domain=mydomain.com; Secure; Expires=Session;

So the name of the cookie is XSRF-TOKEN.

If I find the time, I'll try out the suggestion with the custom requestInterceptor.

[bnasslahsen]

@schneivo77,

Starting from the next release, you can use this new property to enable CSRF support, while using standard header names:

springdoc.swagger-ui.csrf.enabled=true

You can validate it with the latest snapshot.

[schneivo77]

@bnasslahsen

Works like a charm! Thank you! 👍