title: Spring Security: enable / disable CSRF by client type (browser / non-browser )
body: <p>Spring Security documentation <a href="https://docs.spring.io/spring-security/site/docs/3.2.0.CI-SNAPSHOT/reference/html/csrf.html#d4e2036" rel="nofollow noreferrer">says</a>: </p>
  
  <blockquote>
    <p>"When you use CSRF protection? Our recommendation is to use CSRF
    protection for any request that could be processed by a browser by
    normal users. If you are only creating a service that is used by
    non-browser clients, you will likely want to disable CSRF protection."</p>
  </blockquote>
  
  <p><br>
  What if my service is going to be used by both "browser" and "non-browser" clients such as third party external services, does Spring Security provide a way to disable CSRF exclusively for certain type of clients?</p>