|
@@ -82,6 +82,7 @@ To learn more about CSRF protection for your application, consider the following
|
|
|
CSRF protection is provided by several components that are composed within the {security-api-url}org/springframework/security/web/csrf/CsrfFilter.html[`CsrfFilter`]:
|
|
|
|
|
|
.`CsrfFilter` Components
|
|
|
+[.invert-dark]
|
|
|
image::{figures}/csrf.png[]
|
|
|
|
|
|
CSRF protection is divided into two parts:
|
|
@@ -90,6 +91,7 @@ CSRF protection is divided into two parts:
|
|
|
2. Determine if the request requires CSRF protection, load and validate the token, and <<csrf-access-denied-handler,handle `AccessDeniedException`>>.
|
|
|
|
|
|
.`CsrfFilter` Processing
|
|
|
+[.invert-dark]
|
|
|
image::{figures}/csrf-processing.png[]
|
|
|
|
|
|
* image:{icondir}/number_1.png[] First, the {security-api-url}org/springframework/security/web/csrf/DeferredCsrfToken.html[`DeferredCsrfToken`] is loaded, which holds a reference to the <<csrf-token-repository,`CsrfTokenRepository`>> so that the persisted `CsrfToken` can be loaded later (in image:{icondir}/number_4.png[]).
|