Java: Cross-Site Request Forgery (CSRF)

Spring Security generates CSRF tokens and validates them with each request.

In Spring Security, CSRF protection is enabled by default. It works by generating a unique CSRF token for each user session. This token is sent as a hidden field in forms and must be included in any state-changing request (like POST) to the server. When the server receives a request, it validates the CSRF token to ensure that the request is legitimate. If a malicious site tries to forge a request, it won't have access to the valid CSRF token, thus preventing the attack. Imagine an e-commerce site where a purchase button is protected by a CSRF token. If an attacker tries to simulate a purchase through a malicious script, the server will reject the request due to a missing or invalid CSRF token.