spring-projects / spring-projects/spring-security
SEC-2947: @NoCsrf annotation for MVC RequestMappings
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Christopher Smith (Migrated from SEC-2947) said:
I am writing an endpoint for a third-party component that does not provide a simple way to set a CSRF token. Instead of having to specify the CSRF policy in the central configuration, it would be helpful to have an annotation that can be applied at the mapping level, similar to @PreAuthorize, that indicates that "this method should be exempted from CSRF".
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files or tests. Start by locating the MVC RequestMapping and CSRF processing entry points in the Spring Security codebase; done means a mapping-level annotation can exempt the targeted endpoint from CSRF, with tests covering that behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100