Improve documentation about CRSF and WebSocket

I am with the current problem described here:

• Spring Security for WebSocket: No bean named 'stompWebSocketHandlerMapping' available

And seems the following is mandatory ('possible' answer/solution):

• Spring websocket authentication with spring security: 401 error

The current Spring Security Reference Documentation in the 23. WebSocket Security section, "practically" does not teach how configure Spring Security with WebSocket and keeping CSRF.

Thus, by the moment I must disable CRSF, therefore override the sameOriginDisabled method

@Override
 protected boolean sameOriginDisabled() {
       return true;
 }

The problem is I don't want disable CRSF, thus avoid override the sameOriginDisabled method , but this 'missing' stompWebSocketHandlerMapping problem arises.

Not sure if it is a bug or something else is need it to be configured, if is the latter it must be included in the reference documentation.

Thus for this post consider the scenario about never override the sameOriginDisabled method and define/configure the stompWebSocketHandlerMapping bean that is expected.

Thank You

Start with the linked Spring Security Reference Documentation's WebSocket Security section and compare it with the configuration described in the issue and linked discussions. The documentation is done when it explains how to use WebSocket security while retaining CSRF, including the expected stompWebSocketHandlerMapping configuration.