Renaming the CSRF token header name with Spring Security
angularjs, spring-mvc, spring-security
Solution
You could create your own bean instance of `HttpSessionCsrfTokenRepository`, set the property `headerName` on this instance and pass a reference to this instance to CSRF configuration as `<security:csrf token-repository-ref="..." />`. For example,
<bean id="csrfTokenRepository" class="org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository">
<property name="headerName" value="X-SECURITY" />
</bean>
<security:http>
<security:csrf token-repository-ref="csrfTokenRepository" />
</security:http>
Problem
I am in reference to the following Spring Security documentation about csrf configuration. It seems the default header name for the csrf token is: `X-CSRF-TOKEN` As explained in the documentation: ``` <meta name="_csrf" content="${_csrf.token}"/> <!-- default header name is X-CSRF-TOKEN --> <meta name="_csrf_header" content="${_csrf.headerName}"/> ``` It seems AngularJs uses the following header name: `X-XSRF-TOKEN` - How can I change the header name on the Spring security side? - Is this the best way to proceed? - Will it impact the CSRF protection on classic non-ajax form submits and specifically the XSRF parameter name?