summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--cps-rest/src/main/java/org/onap/cps/config/WebSecurityConfig.java5
1 files changed, 5 insertions, 0 deletions
diff --git a/cps-rest/src/main/java/org/onap/cps/config/WebSecurityConfig.java b/cps-rest/src/main/java/org/onap/cps/config/WebSecurityConfig.java
index 943e02c273..5538341118 100644
--- a/cps-rest/src/main/java/org/onap/cps/config/WebSecurityConfig.java
+++ b/cps-rest/src/main/java/org/onap/cps/config/WebSecurityConfig.java
@@ -44,6 +44,11 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
private static final String USER_ROLE = "USER";
@Override
+ // The team decided to disable default CSRF Spring protection and not implement CSRF tokens validation.
+ // CPS is a stateless REST API that is not as vulnerable to CSRF attacks as web applications running in
+ // web browsers are. CPS does not manage sessions, each request requires the authentication token in the header.
+ // See https://docs.spring.io/spring-security/site/docs/5.3.8.RELEASE/reference/html5/#csrf
+ @SuppressWarnings("squid:S4502")
protected void configure(final HttpSecurity http) throws Exception {
http
.csrf().disable()