How do disable CSRF for the specific origin - spring-boot

Question

I needed to add auth in Swagger, but I have no idea how to pass the CSRF token to each request. If I disabled the CSRF token protection then it works fine, but its not a solution, so now I need to disable CSRF for this specific origin
#Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http
.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
.and()
.exceptionHandling().authenticationEntryPoint(authEntryPoint)
.and()
.authorizeHttpRequests()
.antMatchers("/swagger-resources/**","/v2/api-docs","/swagger- ui/**","/auth/**","/user","/csrf")
.permitAll()
.anyRequest()
.authenticated()
.and()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authenticationProvider(authenticationProvider)
.addFilterBefore(malformedTokenHandler, LogoutFilter.class)
.addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);
return http.build();
}
I also have SwaggerConfig class like this:
public class SwaggerConfig {
#Bean
public Docket api() {
return new Docket(DocumentationType.SWAGGER_2)
.securityContexts(Arrays.asList(securityContext()))
.securitySchemes(Arrays.asList(apiKey()))
.select()
.apis(RequestHandlerSelectors.any())
.paths(PathSelectors.any())
.build();
}
public void addResourceHandlers(ResourceHandlerRegistry registry) {
registry.addResourceHandler("swagger-ui.html")
.addResourceLocations("classpath:/META-INF/resources/");
registry.addResourceHandler("/webjars/**")
.addResourceLocations("classpath:/META-INF/resources/webjars/");
}
private ApiKey apiKey() {
return new ApiKey("JWT", "Authorization", "header");
}
List<SecurityReference> defaultAuth() {
AuthorizationScope authorizationScope
= new AuthorizationScope("global", "accessEverything");
AuthorizationScope[] authorizationScopes = new AuthorizationScope[1];
authorizationScopes[0] = authorizationScope;
return Arrays.asList(new SecurityReference("JWT", authorizationScopes));
}
private List<Parameter> operationParameters(CsrfTokenRepository csrfTokenRepository) {
HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.currentRequestAttributes()).getRequest();
CsrfToken csrfToken = csrfTokenRepository.loadToken(request);
return Arrays.asList(
new ParameterBuilder()
.name("X-CSRF-TOKEN")
.modelRef(new ModelRef("string"))
.parameterType("header")
.defaultValue(csrfToken.getToken())
.required(false)
.build());
}
}
I tried:
http.csrf().ignoringAntMatchers("/swagger-resources/**","/v2/api-docs","/swagger-ui/**")
But still it doesn't work.

Answer 1

Try:
http.csrf().requireCsrfProtectionMatcher(yourCsrfMatcher)
and you'll find the documention for the class RequestMatcher here:
public class YourCsrfMatcher implements RequestMatcher {
#override
public boolean matches(HttpServletRequest request){
// add your logic here and return false for the specific origin
return true;
}
}