HIGH AI PREVALENCE: HIGH auth.java.web.csrf-disabled

Spring Security CSRF protection is disabled.

CWE-352 OWASP A01:2021 java

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

With CSRF off, an attacker can forge state-changing requests that a logged-in victim's browser submits with their session cookie (CWE-352). This is one of the most common AI-generated Spring mistakes: csrf().disable() is pasted in to "make the API work" and never removed.

Keep CSRF protection enabled. For a stateless API authenticated with bearer tokens (not cookies), scope it instead (e.g. ignore specific paths or use a CookieCsrfTokenRepository) rather than disabling it globally.

VULNERABLE

vulnerable.java

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.web.SecurityFilterChain;

class SecurityConfig {

    SecurityFilterChain legacy(HttpSecurity http) throws Exception {
        // ruleid: auth.java.web.csrf-disabled
        http.csrf().disable();
        return http.build();
    }

    SecurityFilterChain lambda(HttpSecurity http) throws Exception {
        // ruleid: auth.java.web.csrf-disabled
        http.csrf(csrf -> csrf.disable());
        return http.build();
    }

    SecurityFilterChain methodRef(HttpSecurity http) throws Exception {
        // ruleid: auth.java.web.csrf-disabled
        http.csrf(AbstractHttpConfigurer::disable);
        return http.build();
    }
}

SAFE

safe.java

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.csrf.CookieCsrfTokenRepository;

class SecurityConfigSafe {

    // ok: auth.java.web.csrf-disabled -- CSRF left enabled (default)
    SecurityFilterChain enabled(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated());
        return http.build();
    }

    // ok: auth.java.web.csrf-disabled -- CSRF kept on with a cookie token repository
    SecurityFilterChain cookieRepo(HttpSecurity http) throws Exception {
        http.csrf(csrf -> csrf.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()));
        return http.build();
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.java.web.csrf-disabled -- <reason>

References

https://docs.spring.io/spring-security/reference/servlet/exploits/csrf.html ↗https://cwe.mitre.org/data/definitions/352.html ↗