There are many tutorials where is shown how to disable csrf,
csrf().disable()
(and other possibilities like .properties
, .y
Spring recommend to use it when serving browser clients, if not it may be disabled:
Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-browser clients, you will likely want to disable CSRF protection.
I will add that even if you server browsers clients, but it's use internally only you may want/able to remove it.