False positive Java. SpringBoot CSRF

Commencez par localiser la requête CodeQL nommée "Disabled Spring CSRF protection" et examinez comment elle identifie les configurations Spring Security. Reproduisez ensuite l’exemple fourni de stateless JWT/OIDC resource-server, puis vérifiez que la désactivation de CSRF ne déclenche plus la requête pour cette configuration, tandis que le cas signalé reste couvert.

Description of the false positive

Given a SpringBoot application that acts solely as an API/OIDC Resource Server and does not utilize cookies or state, where CSRF is disabled, the CodeQL / Disabled Spring CSRF protection should not be triggered.

Code samples or links to source code

  @Bean
  SecurityFilterChain securityFilterChain(
      final HttpSecurity http,
      final String privateScope,
      final AppUserPrincipalJwtAuthenticationConverter appUserPrincipalJwtAuthenticationConverter) {
    http.formLogin(AbstractHttpConfigurer::disable)
        .httpBasic(AbstractHttpConfigurer::disable)
        .csrf(AbstractHttpConfigurer::disable) // NOSONAR stateless JWT, no CSRF cookies
        .logout(AbstractHttpConfigurer::disable)
        .sessionManagement(
            session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
        .authorizeHttpRequests(
            authorize ->
                authorize
                    .dispatcherTypeMatchers(DispatcherType.ERROR, DispatcherType.FORWARD)
                    .permitAll()
                    .requestMatchers(RuntimeEndpointPaths.unauthenticatedPaths())
                    .permitAll()
                    .requestMatchers(
                        new RegexRequestMatcher(
                            RuntimeEndpointPaths.versionedInternalRouteRegex(), null))
                    .access(interactiveUserAuthorizationManager())
                    .requestMatchers(
                        new RegexRequestMatcher(
                            RuntimeEndpointPaths.versionedPrivateRouteRegex(), null))
                    .access(
                        callerTypeAuthorizationManager(
                            OidcCallerType.CLIENT_CREDENTIALS, privateScope))
                    .anyRequest()
                    .authenticated())
        .oauth2ResourceServer(
            oauth2 ->
                oauth2.jwt(
                    jwt ->
                        jwt.jwtAuthenticationConverter(
                            appUserPrincipalJwtAuthenticationConverter)));
    return http.build();
  }