Cette page n'est pas encore disponible en français, sa traduction est en cours. Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.
Classes that contain methods annotated with RequestMapping are by default mapped to all the HTTP request methods.
Spring Security’s CSRF protection is not enabled by default for the HTTP request methods GET, HEAD, TRACE, and OPTIONS.
For this reason, requests or routes with RequestMapping, and not narrowing the mapping to the HTTP request methods POST, PUT, DELETE, or PATCH, makes them vulnerable to CSRF attacks.
@ControllerpublicclassUnsafeController{@RequestMapping("/path")publicvoidwriteData(){// State-changing operations performed within this method.}}
Compliant Code Examples
@ControllerpublicclassSafeController{/**
* For methods without side-effects use @GetMapping.
*/@GetMapping("/path")publicStringreadData(){// No state-changing operations performed within this method.return"";}/**
* For state-changing methods use either @PostMapping, @PutMapping, @DeleteMapping, or @PatchMapping.
*/@PostMapping("/path")publicvoidwriteData(){// State-changing operations performed within this method.}}
Seamless integrations. Try Datadog Code Analysis
Datadog Code Analysis
Try this rule and analyze your code with Datadog Code Analysis
How to use this rule
1
2
rulesets:- java-security # Rules to enforce Java security.
Create a static-analysis.datadog.yml with the content above at the root of your repository
Use our free IDE Plugins or add Code Analysis scans to your CI pipelines
