Skip to content

Commit

Permalink
Update README.MD
Browse files Browse the repository at this point in the history
  • Loading branch information
ch4mpy authored Nov 22, 2024
1 parent b302317 commit d3b3138
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion spring-addons-starter-oidc/README.MD
Original file line number Diff line number Diff line change
Expand Up @@ -330,7 +330,7 @@ By default, a `GrantedAuthoritiesMapper` using the authorities converter bean in
#### 1.2.7. <a name="1-2-7"/>CSRF protection
Requests to an OAuth2 client are authorized with session cookies, which exposes it to CSRF attacks. As a consequence, **CSRF protection should always be enabled on OAuth2 clients**.

The default is the with `spring-addons-starter-oidc` as it is with `spring-boot-starter-oauth2-client` (session).
The default with `spring-addons-starter-oidc` is the same as with `spring-boot-starter-oauth2-client` (session).

When setting `com.c4-soft.springaddons.oidc.client.csrf=cookie-accessible-from-js`, as needed by single-page and mobile applications, the CSRF token is exposed in a token and the required filter is registered.

Expand Down

0 comments on commit d3b3138

Please sign in to comment.