Disabled CSRF (ARCH4125)

Key java.security.disabled-csrf · Severity warning · Category security · CWE CWE-352

Disabling CSRF protection on cookie-based sessions lets attackers trigger state-changing requests from a victim’s browser. Keep CSRF protection enabled for browser-based sessions.

Incorrect

@Bean
SecurityFilterChain chain(HttpSecurity http) throws Exception {
    http.csrf(csrf -> csrf.disable()); // CSRF off
    return http.build();
}

Correct

@Bean
SecurityFilterChain chain(HttpSecurity http) throws Exception {
    http.csrf(csrf -> csrf
        .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()));
    return http.build();
}

Fix

Keep token-based CSRF protection enabled for cookie-session apps instead of disabling it.