|
@@ -205,7 +205,7 @@ By storing the expected CSRF in a cookie, JavaScript frameworks like https://doc
|
|
[[servlet-csrf-include-ajax-meta]]
|
|
[[servlet-csrf-include-ajax-meta]]
|
|
===== Meta tags
|
|
===== Meta tags
|
|
|
|
|
|
-An alternative pattern to <<servlet-csrf-include-form-attr-auto,exposing the CSRF in a cookie>> is to include the CSRF token within your `meta` tags.
|
|
|
|
|
|
+An alternative pattern to <<servlet-csrf-include-form-auto,exposing the CSRF in a cookie>> is to include the CSRF token within your `meta` tags.
|
|
The HTML might look something like this:
|
|
The HTML might look something like this:
|
|
|
|
|
|
.CSRF meta tag HTML
|
|
.CSRF meta tag HTML
|
|
@@ -278,7 +278,7 @@ Refer to <<csrf-considerations>> for a more general discussion.
|
|
It is important to <<csrf-considerations-login,require CSRF for log in>> requests to protect against forging log in attempts.
|
|
It is important to <<csrf-considerations-login,require CSRF for log in>> requests to protect against forging log in attempts.
|
|
Spring Security's servlet support does this out of the box.
|
|
Spring Security's servlet support does this out of the box.
|
|
|
|
|
|
-[[servlet-considerations-csrf-login]]
|
|
|
|
|
|
+[[servlet-considerations-csrf-logout]]
|
|
=== Logging Out
|
|
=== Logging Out
|
|
|
|
|
|
It is important to <<csrf-considerations-logout,require CSRF for log out>> requests to protect against forging log out attempts.
|
|
It is important to <<csrf-considerations-logout,require CSRF for log out>> requests to protect against forging log out attempts.
|