Feature Request: Support for Spring CSRF filter
- Dominant language
- Groovy
- Stars
- 2.9k
- Forks
- 975
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 92
Description
I know we can manually use withForm() on each post/put/delete/patch method in every controller, but it would be great to have a Filter option for CSRF to take care of this across the whole app. Spring has this already.
http://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html
So, this is a feature request to integrate Spring's CSRF filter for grails 2 and 3.
Thanks
Contributor guide
Research direction
Start with the existing withForm() usage in the application controllers and read the linked Spring Security CSRF reference. Determine how a filter option should apply across Grails 2 and 3, then verify that POST, PUT, DELETE, and PATCH requests are protected without per-controller configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- groovy, spring
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100