apache / apache/grails-core

Feature Request: Support for Spring CSRF filter

Open
#15,868 1 comment 0 reactions 0 assignees View on GitHub
relates-to:spring-security
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

I know we can manually use withForm() on each post/put/delete/patch method in every controller, but it would be great to have a Filter option for CSRF to take care of this across the whole app. Spring has this already.
http://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html

So, this is a feature request to integrate Spring's CSRF filter for grails 2 and 3.

Thanks

Contributor guide

Open the contributing guide

Research direction

Start with the existing withForm() usage in the application controllers and read the linked Spring Security CSRF reference. Determine how a filter option should apply across Grails 2 and 3, then verify that POST, PUT, DELETE, and PATCH requests are protected without per-controller configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy, spring
Domain
backend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.