Take the 2-minute tour ×

What is the best way to protect our Spring MVC application from CSRF and XSS.

Is there native Spring MVC support for this?

share|improve this question
add comment

3 Answers

In Spring:

Forms ( globally):


Forms ( locally):

<spring:htmlEscape defaultHtmlEscape="true" />
share|improve this answer
Thank you @Abhi. And how about CSRF protection. Is there native support? –  Fitrah M Jan 24 '12 at 3:07
add comment

You can use Spring Security 3.2.0.RELEASE and enable csrf support with this configuration

    <!-- ... -->
    <csrf />
share|improve this answer
add comment

Your Answer


