When is CSRF protection required in Spring Security?

Bases CSRF policy on whether browsers automatically attach credentials and keeps unsafe requests protected without disabling security globally.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

CSRF matters when a browser automatically sends authentication credentials, especially session cookies, on a state-changing request. Spring Security enables CSRF protection by default for unsafe methods in Servlet applications. The server issues a token tied to the user's context, and the legitimate application sends it in a request value an attacker cannot cause the browser to add automatically. Safe methods must remain free of side effects.

Full answer below

Practice focus

Browser credential behavior, CSRF tokens, cookies, bearer headers, SameSite, CORS, and endpoint-specific configuration.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Overview
CSRF is about a malicious site causing a browser to send trusted credentials, not about whether the response is readable.
CSRF matters when a browser automatically sends authentication credentials, especially session cookies, on a state-changing request. Spring Security enables CSRF protection by default for unsafe methods in Servlet applications. The server issues a token tied to the user's context, and the legitimate application sends it in a request value an attacker cannot cause the browser to add automatically. Safe methods must remain free of side effects.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
An API using only bearer tokens supplied explicitly in the Authorization header is usually not exposed to classic CSRF in the same way, but adding cookie authentication changes that conclusion. SameSite cookies reduce risk but are not a complete replacement for deliberate CSRF policy across redirects, subdomains, and browser clients. CORS controls which origins can read or send approved cross-origin requests; it is not CSRF protection and does not stop simple forged submissions.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Disabling CSRF because the application returns JSON.
Calling CORS a CSRF defense.
Allowing state changes on GET.

When is CSRF protection required in Spring Security?

Practice focus

Answer path

Overview

Review signals

Follow-up prompts

Continue the section

Tech stacks

Skill areas

Suggest an improvement

Found this answer useful?