spring-projects / spring-projects/spring-security
CsrfDsl does not have a spa() configuration method.
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
According to the documentation, org.springframework.security.config.annotation.web.CsrfDsl should have a spa() configuration method, but it doesn't.
https://docs.spring.io/spring-security/reference/servlet/exploits/csrf.html#csrf-integration-javascript-spa
To Reproduce
@Bean
open fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
http {
// ...
csrf {
spa()
}
}
return http.build()
}
Expected behavior
According to the documentation, CsrfDsl should have a spa() configuration method.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the CsrfDsl API and the linked CSRF SPA documentation section, then reproduce the Kotlin securityFilterChain example from the issue. Confirm whether the documented spa() configuration is missing from the DSL or the documentation; done means the example and the available API agree and are covered by the relevant project tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, kotlin, spring
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100