CsrfAutoConfiguration class final

Auto-configuration class that registers CSRF protection components in the Jetleaf application context.

This configuration automatically provides:

1. DefaultCsrfTokenRepositoryManager - For managing CSRF token repositories
2. CsrfFilter - For enforcing CSRF protection

Automatic Registration

When this configuration is present in the application context, CSRF protection is automatically enabled and configured based on environment properties.

Customization

Applications can override the default CSRF configuration by:

1. Providing a custom CsrfTokenRepository implementation as a pod
2. Configuring CSRF behavior via environment properties
3. Disabling CSRF globally via jetleaf.web.csrf.enabled=false

Environment Properties

jetleaf.web.csrf.enabled=true
jetleaf.web.csrf.header-name=X-CSRF-TOKEN
jetleaf.web.csrf.parameter-name=_csrf

Example

@Configuration()
class WebConfiguration {
  // CsrfAutoConfiguration is automatically applied
  // No additional setup needed
}

// To customize:
@Component()
class SessionCsrfTokenRepository implements CsrfTokenRepository {
  // Custom implementation
}