private HttpSecurity handleCsrf(final HttpSecurity http)
            throws Exception {
        if ("test".equals(activeProfile)) {
            return http.csrf().disable();
        } else {
            return http.csrf().ignoringAntMatchers(
                        "/gedbrowserng/v1/login",
                        "/gedbrowserng/v1/signup")
                    .csrfTokenRepository(
                            CookieCsrfTokenRepository.withHttpOnlyFalse())
                    .and();
        }
    }
private HttpSecurity handleCsrf ( final HttpSecurity http ) throws Exception { if ( "test" . equals ( activeProfile ) ) { return http . csrf ( ) . disable ( ) ; } else { return http . csrf ( ) . ignoringAntMatchers ( "/gedbrowserng/v1/login" , "/gedbrowserng/v1/signup" ) . csrfTokenRepository ( CookieCsrfTokenRepository . withHttpOnlyFalse ( ) ) . and ( ) ; } }
Work from the http security object and enable or disable CSRF handling,
as requested in the application properties.

@param http the http security object
@return the http security object
@throws Exception if there is a problem