diff --git a/docs/manual/src/asciidoc/index.adoc b/docs/manual/src/asciidoc/index.adoc index 603b702403..4ac8667d4b 100644 --- a/docs/manual/src/asciidoc/index.adoc +++ b/docs/manual/src/asciidoc/index.adoc @@ -3124,8 +3124,7 @@ public class WebSecurityConfig extends [[csrf-include-csrf-token-form]] ===== Form Submissions -The last step is to ensure that you include the CSRF token in all PATCH, POST, PUT, and DELETE methods. This can be done using the _csrf request attribute to obtain the current CsrfToken. An example of doing this with a JSP is shown below: - +The last step is to ensure that you include the CSRF token in all PATCH, POST, PUT, and DELETE methods. One way to approach this is to use the `_csrf` request attribute to obtain the current `CsrfToken`. An example of doing this with a JSP is shown below: [source,xml] ---- @@ -3140,9 +3139,11 @@ The last step is to ensure that you include the CSRF token in all PATCH, POST, P ---- +An easier approach is to use <> from the Spring Security JSP tag library. + [NOTE] ==== -If you are using Spring MVC tag or http://www.thymeleaf.org/whatsnew21.html#reqdata[Thymeleaf 2.1+], the `CsrfToken` is automatically included for you if you replace `@EnableWebSecurity` with `@EnableWebMvcSecurity` using the `CsrfRequestDataValueProcessor`. +If you are using Spring MVC `` tag or http://www.thymeleaf.org/whatsnew21.html#reqdata[Thymeleaf 2.1+], and you replace `@EnableWebSecurity` with `@EnableWebMvcSecurity`, the `CsrfToken` is automatically included for you (using the `CsrfRequestDataValueProcessor`). ==== [[csrf-include-csrf-token-ajax]] @@ -3162,6 +3163,8 @@ If you using JSON, then it is not possible to submit the CSRF token within an HT ---- +Instead of manually creating the meta tags, you can use the simpler <> from the Spring Security JSP tag library. + You can then include the token within all your Ajax requests. If you were using jQuery, this could be done with the following: [source,javascript] @@ -5034,6 +5037,88 @@ The permissions are passed to the `PermissionFactory` defined in the application This tag also supports the `var` attribute, in the same way as the `authorize` tag. +=== The csrfField Tag +If CSRF protection is enabled, this tag inserts a hidden form field with the correct name and value for the CSRF protection token. If CSRF protection is not enabled, this tag outputs nothing. + +Normally Spring Security automatically inserts a CSRF form field for any `` tags you use, but if for some reason you cannot use ``, `csrfField` is a handy replacement. + +You should place this tag within an HTML `
` block, where you would normally place other input fields. Do NOT place this tag within a Spring `` block—Spring Security handles Spring forms automatically. + +[source,xml] +---- +
+ + Name:
+ + ... + +---- + + +=== The csrfMetaTags Tag +If CSRF protection is enabled, this tag inserts meta tags containing the CSRF protection token form field and header names and CSRF protection token value. These meta tags are useful for employing CSRF protection within JavaScript in your applications. + +You should place `csrfMetaTags` within an HTML `` block, where you would normally place other meta tags. Once you use this tag, you can access the form field name, header name, and token value easily using JavaScript. JQuery is used in this example to make the task easier. + +[source,xml] +---- + + + + CSRF Protected JavaScript Page + + +