spring-projects / spring-projects/spring-security
Add guidance on REST API and CSRF to docs
Open
Nobody has claimed this yet.
in: docs
status: feedback-provided
type: enhancement
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Docs section Cross Site Request Forgery is missing any discussion on weather CSRF is recommended / required for a REST API. Suggest adding content to the section to answer the following questions.
- Is CSRF protection required for a REST API? When is it required when is it not?
- What are the implications on the client making calls for a REST end point that has CSRF?
- How to configure a RestTemplate to make calls that factor in CSRF protection?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Cross Site Request Forgery documentation section linked in the issue, then review the existing REST API and RestTemplate guidance in the documentation. Add clear answers about when CSRF is required for REST APIs, client implications, and RestTemplate configuration; the section is done when all three questions are addressed consistently with Spring Security behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100