Disabled CSRF (ARCH8125)

Key kotlin.security.disabled-csrf · Severity warning · Category security · CWE CWE-352

Flags csrf().disable() / csrf { disable() } in a Spring Security configuration.

Incorrect

http.csrf { it.disable() }

Correct

http.csrf { it.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()) }

Fix

Keep CSRF on for cookie-authenticated endpoints; disable only for token-only stateless APIs, per route.