Disabled CSRF (ARCH8125)
Key kotlin.security.disabled-csrf · Severity warning · Category security · CWE CWE-352
Flags csrf().disable() / csrf { disable() } in a Spring Security configuration.
Incorrect
Section titled “Incorrect”http.csrf { it.disable() }Correct
Section titled “Correct”http.csrf { it.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()) }Keep CSRF on for cookie-authenticated endpoints; disable only for token-only stateless APIs, per route.