spring-projects / spring-projects/spring-boot
Investigate CSRF alternative for actuator endpoints
Open
Nobody has claimed this yet.
status: pending-design-work
type: enhancement
- Dominant language
- Java
- Stars
- 81.5k
- Forks
- 42.7k
- Avg merge
- 2d 4h
- Merged PRs (30d)
- 65
Description
It would be nice if there was a way to easily make POST requests to actuator endpoints without needing to disable CSRF protection.
See #24611 for background.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading issue #24611 for the stated background, then trace how CSRF protection applies to POST requests for actuator endpoints. Clarify the intended alternative and its security constraints before identifying the relevant actuator and security entry points. Done means a defined, documented way to permit these requests without disabling CSRF protection.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring-boot
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100