• Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Liutauras Vilda
  • Jeanne Boyarsky
  • Devaka Cooray
  • Paul Clapham
Sheriffs:
  • Tim Cooke
  • Knute Snortum
  • Bear Bibeault
Saloon Keepers:
  • Ron McLeod
  • Tim Moores
  • Stephan van Hulst
  • Piet Souris
  • Ganesh Patekar
Bartenders:
  • Frits Walraven
  • Carey Brown
  • Tim Holloway

Spring Security Implementation for REST API

 
Ranch Hand
Posts: 499
Spring AngularJS Java
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Hi guys,

We have just now started a new project with Spring and Hibernate. We should provide them the admin panel and REST API's. I recently implemented Spring security in the project. Since CSRF is enabled by default, when API is hit it asks for CSRF token. Incase I decide to remove the login form and CSRF from spring security, my admin panel will get affected. What do I do in this case? Also I read about cookie based authentication for REST API's but the articles were not clear. Can some one guide me through this?

Here is the code snippet I using for spring security.
 
Saloon Keeper
Posts: 10308
217
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Why would you want to remove the CSRF token?

Cookie based authentication pretty much just works by storing the currently logged-in user in a signed cookie. When the browser sends such a cookie to the server, it says "Hey, I previously logged in as this user, so don't ask me for a password again". To prevent a client from forging the user name, the cookie is signed so it can be verified by the server.
 
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
Boost this thread!