You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
69 lines
1.1 KiB
69 lines
1.1 KiB
[[test-mockmvc-csrf]] |
|
= Testing with CSRF Protection |
|
|
|
When testing any non-safe HTTP methods and using Spring Security's CSRF protection, you must include a valid CSRF Token in the request. |
|
To specify a valid CSRF token as a request parameter use the CSRF xref:servlet/test/mockmvc/request-post-processors.adoc[`RequestPostProcessor`] like so: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
mvc |
|
.perform(post("/").with(csrf())) |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
mvc.post("/") { |
|
with(csrf()) |
|
} |
|
---- |
|
====== |
|
|
|
If you like, you can include CSRF token in the header instead: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
mvc |
|
.perform(post("/").with(csrf().asHeader())) |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
mvc.post("/") { |
|
with(csrf().asHeader()) |
|
} |
|
---- |
|
====== |
|
|
|
You can also test providing an invalid CSRF token by using the following: |
|
|
|
[tabs] |
|
====== |
|
Java:: |
|
+ |
|
[source,java,role="primary"] |
|
---- |
|
mvc |
|
.perform(post("/").with(csrf().useInvalidToken())) |
|
---- |
|
|
|
Kotlin:: |
|
+ |
|
[source,kotlin,role="secondary"] |
|
---- |
|
mvc.post("/") { |
|
with(csrf().useInvalidToken()) |
|
} |
|
---- |
|
======
|
|
|