Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch '6.2.x' into 6.3.x

This commit is contained in:
Josh Cummings 2024-07-29 15:10:32 -06:00
parent abaab2ef55 e51507e32d
commit 97a49e18b9
No known key found for this signature in database
GPG Key ID: A306A51F43B8E5A5
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
docs/modules/ROOT/pages/servlet/exploits/csrf.adoc
View File

@ -130,7 +130,7 @@ You can also specify <<csrf-token-repository-custom,your own implementation>> to
By default, Spring Security stores the expected CSRF token in the `HttpSession` by using {security-api-url}org/springframework/security/web/csrf/HttpSessionCsrfTokenRepository.html[`HttpSessionCsrfTokenRepository`], so no additional code is necessary.
The `HttpSessionCsrfTokenRepository` reads the token from an HTTP request header named `X-CSRF-TOKEN` or the request parameter `_csrf` by default.
The `HttpSessionCsrfTokenRepository` reads the token from a session (whether in-memory, cache, or database). If you need to access the session attribute directly, please first configure the session attribute name using `HttpSessionCsrfTokenRepository#setSessionAttributeName`.
You can specify the default configuration explicitly using the following configuration: