High severityJavaInsecure ConfigurationHIGH confidence

Spring Security CSRF Disabled

Spring Security CSRF protection is explicitly disabled (CWE-352).

Standards mapping

CWE: CWE-352: Cross-Site Request Forgery (CSRF)
OWASP Top 10: A01:2021 - Broken Access Control
OWASP ASVS: V4.2.2 (L1)

Vulnerable vs. safe

Flagged by this check

http.csrf().disable();

Passes - the safe pattern

http.csrf(Customizer.withDefaults());

Why it matters & how to fix it

Spring Security CSRF protection is explicitly disabled (CWE-352). Any cookie-authenticated, state-changing endpoint becomes forgeable from a malicious site. Leave CSRF enabled for browser-facing apps; only disable it for stateless APIs that authenticate with a bearer token (not cookies), and scope the exemption narrowly.

References

Rule ID integsec-java-spring-security-csrf-disabled - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.

TurboPentest runs this check automatically

Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.

Start a pentest

Related checks