CSRF Protection in Web Applications with Java

Cross-Site Request Forgery (CSRF) is a critical web security vulnerability that allows attackers to trick users into performing actions they didn't intend to perform. This article explores CSRF protection mechanisms in Java web applications.

Understanding CSRF

CSRF attacks occur when a malicious website causes a user's browser to perform unwanted actions on a trusted site where the user is authenticated. For example, an attacker could force a user to change their email address, transfer funds, or make purchases without their consent.

CSRF Protection Strategies

1. Synchronizer Token Pattern

The most common CSRF protection method involves generating a unique, unpredictable token for each user session and including it in forms and AJAX requests.

2. SameSite Cookies

Using SameSite cookie attributes prevents browsers from sending cookies along with cross-site requests.

3. Custom Headers

Requiring custom headers for state-changing requests since they cannot be sent cross-origin without CORS permission.

Implementing CSRF Protection in Spring Security

Spring Security provides built-in CSRF protection that's enabled by default.

Configuration

@Configuration @EnableWebSecurity public class SecurityConfig { @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http .csrf(csrf -> csrf .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()) .ignoringRequestMatchers("/api/public/**") ) .authorizeHttpRequests(authz -> authz .requestMatchers("/public/**").permitAll() .anyRequest().authenticated() ) .formLogin(form -> form .loginPage("/login") .permitAll() ); return http.build(); } }

Manual CSRF Token Management

@Controller public class CsrfController { @GetMapping("/form") public String showForm(Model model) { // CSRF token is automatically added by Thymeleaf return "form-page"; } @PostMapping("/update-profile") public String updateProfile(@Valid UserProfile profile) { // CSRF protection is automatic return "redirect:/success"; } }

Custom CSRF Protection Implementation

For applications not using Spring Security, here's how to implement CSRF protection manually:

1. CSRF Token Generator

@Component public class CsrfTokenManager { private static final String CSRF_TOKEN_NAME = "X-CSRF-TOKEN"; private static final int TOKEN_LENGTH = 32; public String generateToken() { byte[] bytes = new byte[TOKEN_LENGTH]; new SecureRandom().nextBytes(bytes); return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes); } public boolean isValidToken(String storedToken, String receivedToken) { return storedToken != null && storedToken.equals(receivedToken); } public String getTokenName() { return CSRF_TOKEN_NAME; } }

2. CSRF Filter

@WebFilter("/*") public class CsrfFilter implements Filter { @Inject private CsrfTokenManager tokenManager; @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest httpRequest = (HttpServletRequest) request; HttpServletResponse httpResponse = (HttpServletResponse) response; HttpSession session = httpRequest.getSession(false); // Generate token for new sessions if (session != null && session.getAttribute(tokenManager.getTokenName()) == null) { String token = tokenManager.generateToken(); session.setAttribute(tokenManager.getTokenName(), token); } // Validate token for state-changing requests if (requiresCsrfProtection(httpRequest)) { String sessionToken = session != null ? (String) session.getAttribute(tokenManager.getTokenName()) : null; String requestToken = getTokenFromRequest(httpRequest); if (!tokenManager.isValidToken(sessionToken, requestToken)) { httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN, "Invalid CSRF Token"); return; } } chain.doFilter(request, response); } private boolean requiresCsrfProtection(HttpServletRequest request) { String method = request.getMethod(); return "POST".equals(method) || "PUT".equals(method) || "DELETE".equals(method) || "PATCH".equals(method); } private String getTokenFromRequest(HttpServletRequest request) { // Check header first, then parameter String token = request.getHeader(tokenManager.getTokenName()); if (token == null) { token = request.getParameter(tokenManager.getTokenName()); } return token; } }

3. JSP with CSRF Protection

<%@ page contentType="text/html;charset=UTF-8" %> <html> <head> <title>User Profile</title> </head> <body> <h2>Update Profile</h2> <form action="update-profile" method="post"> <input type="hidden" name="X-CSRF-TOKEN" value="${sessionScope['X-CSRF-TOKEN']}"> <label for="email">Email:</label> <input type="email" id="email" name="email" required> <label for="name">Name:</label> <input type="text" id="name" name="name" required> <button type="submit">Update</button> </form> <script> // For AJAX requests function getCsrfToken() { return '${sessionScope['X-CSRF-TOKEN']}'; } function updateProfile() { fetch('/update-profile', { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-TOKEN': getCsrfToken() }, body: JSON.stringify({ email: document.getElementById('email').value, name: document.getElementById('name').value }) }); } </script> </body> </html>

CSRF Protection for REST APIs

Stateless CSRF Protection

@RestController public class ApiController { @PostMapping("/api/transfer") public ResponseEntity<?> transferFunds(@RequestBody TransferRequest request, HttpServletRequest httpRequest) { // Validate CSRF token for state-changing operations String csrfToken = httpRequest.getHeader("X-CSRF-TOKEN"); if (!isValidCsrfToken(csrfToken)) { return ResponseEntity.status(HttpStatus.FORBIDDEN).build(); } // Process transfer return ResponseEntity.ok().build(); } private boolean isValidCsrfToken(String token) { // Implement token validation logic return true; } }

Advanced CSRF Protection Techniques

1. Double Submit Cookie Pattern

@Component public class DoubleSubmitCsrfProtection { public void addCsrfTokens(HttpServletResponse response) { String token = UUID.randomUUID().toString(); // Set cookie Cookie cookie = new Cookie("CSRF-TOKEN", token); cookie.setHttpOnly(false); cookie.setSecure(true); cookie.setPath("/"); response.addCookie(cookie); // Also set as header for JavaScript access response.setHeader("X-CSRF-TOKEN", token); } public boolean validateCsrfToken(HttpServletRequest request) { String cookieToken = getCookieValue(request, "CSRF-TOKEN"); String headerToken = request.getHeader("X-CSRF-TOKEN"); return cookieToken != null && cookieToken.equals(headerToken); } private String getCookieValue(HttpServletRequest request, String name) { Cookie[] cookies = request.getCookies(); if (cookies != null) { for (Cookie cookie : cookies) { if (name.equals(cookie.getName())) { return cookie.getValue(); } } } return null; } }

2. Encrypted Token Pattern

@Component public class EncryptedCsrfTokenManager { private final SecretKey secretKey; public EncryptedCsrfTokenManager() { // In production, load from secure configuration secretKey = Keys.secretKeyFor(SignatureAlgorithm.HS256); } public String generateToken(String sessionId) { String tokenData = sessionId + "|" + System.currentTimeMillis(); return Jwts.builder() .setSubject(tokenData) .signWith(secretKey) .compact(); } public boolean validateToken(String token, String sessionId) { try { Claims claims = Jwts.parserBuilder() .setSigningKey(secretKey) .build() .parseClaimsJws(token) .getBody(); String[] parts = claims.getSubject().split("\\|"); return parts.length == 2 && parts[0].equals(sessionId); } catch (JwtException e) { return false; } } }

Testing CSRF Protection

Unit Tests

@SpringBootTest class CsrfProtectionTest { @Autowired private WebApplicationContext context; private MockMvc mockMvc; @BeforeEach void setup() { mockMvc = MockMvcBuilders.webAppContextSetup(context).build(); } @Test void shouldRejectRequestWithoutCsrfToken() throws Exception { mockMvc.perform(post("/update-profile") .contentType(MediaType.APPLICATION_FORM_URLENCODED) .param("email", "[email protected]")) .andExpect(status().isForbidden()); } @Test void shouldAcceptRequestWithValidCsrfToken() throws Exception { mockMvc.perform(post("/update-profile") .contentType(MediaType.APPLICATION_FORM_URLENCODED) .param("email", "[email protected]") .with(csrf())) // Spring Security test support .andExpect(status().isOk()); } }

Best Practices

Enable CSRF Protection by Default: Always enable CSRF protection for state-changing operations
Use Framework Support: Prefer framework-provided CSRF protection when available
Secure Token Storage: Store tokens in HTTP-only cookies when possible
Token Rotation: Consider rotating CSRF tokens after use for sensitive operations
SameSite Cookies: Use SameSite=Strict or SameSite=Lax for session cookies
Exclude Public Endpoints: Disable CSRF protection for truly public APIs
Log CSRF Failures: Monitor and log CSRF validation failures for security analysis

Common Pitfalls to Avoid

Disabling CSRF protection without proper justification
Storing CSRF tokens in localStorage (vulnerable to XSS)
Using predictable CSRF tokens
Forgetting to include CSRF tokens in AJAX requests
Not validating CSRF tokens for all state-changing operations

Conclusion

CSRF protection is essential for web application security. Java frameworks like Spring Security provide robust, built-in CSRF protection that should be used whenever possible. For custom implementations, ensure you follow security best practices and thoroughly test your CSRF protection mechanisms.

Remember that CSRF protection is just one layer of defense in a comprehensive web application security strategy. Always combine it with other security measures like input validation, output encoding, and proper authentication/authorization.