title: Spring Security, Stateless REST service and CSRF
body: <p>I have a REST service, built using Java, Spring-boot and using Spring Security with Basic Access Authentication.  There are no Views, no JSP etc, no 'login', just stateless services which can be called from a React app hosted separately.</p>
  
  <p>I've read a variety of documentation about CSRF protection, but can't decide whether I should be using spring-security CSRF config, or just disabling it?  If I disable the csrf protection I can call the service with curl using my basic auth like this:</p>
  
  <pre><code>curl -H "authorization:Basic c35sdfsdfjpzYzB0dDFzaHA=" -H "content-type:application/json" -d '{"username":"user","password":"password","roles":"USER"}' localhost:8081/api/v1/user
  </code></pre>
  
  <p>If I enable the csrf protection and provide a <code>x-csrf-token</code> header, then the spring CsrfFilter attempts to cross check this against a value from (I think) a session cookie in the <code>HttpServletRequest</code>.  However since its a stateless REST service I don't have a session, and haven't 'logged in'.</p>
  
  <p>I have a config class which looks like this:</p>
  
  <pre><code>@EnableWebSecurity
  @Configuration
  public class ServiceSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
                  .anyRequest().fullyAuthenticated()
                  .and().httpBasic();
          if (!serviceProperties.isCsrfEnabled()) {
              http.csrf().disable();
          }
      }
  </code></pre>
  
  <p>The more I think about it, the more it seems that I will just need to disable CSRF protection.  Is there another way to configure spring security so it will work?</p>
  
  <p>thanks</p>