spring - CSRF token expires during login -

i'm working on spring web application , need avoid problem expire csrf token on login page, because if user waiting long , try login 1 way resolve problem csrf reload page , try login again. it's not user friendly , want avoid situation.

first question: possible in general(by spring security 3.2.4)? without disable csrf.

i tried use security="none" login page , spring seciruty "login_check", it's not working, got infinity redirect or got error no mapping url "myhost/login_check".

second question: how can it?

recommended solution

i should not disable csrf tokens on production site. may make session (and csrf token) last longer (but should not last longer day, not-logged-in users dos vector), real solution may automatically refresh login page when csrf token expires. may use a

<meta http-equiv="refresh" content="csrf_timeout_in_seconds"> 

in login page header. if user lets login page sit hours, should not bother him page got refreshed.

second solution

a possible solution not require store sessions allows infinite timeout can generate csrf tokens hashing session id , server-side secret:

csrf = hash(sessionid+secret) 

note need dig , override spring-security internal mechanisms, namely:

• re-creating anonymous sessions on fly if request arrives , no such session exists
• re-creating csrf token on fly session id

and choose secure hashing algorithm, preferably sha-512.

third solution

you have small javascript calls no-op page on server regularly (just before session timeout), extending session. results in infinite session timeout if browser on time, dos aspect mitigated.

ok, 1 last solution

you can alter csrf token checking code, , disable login page. synonymous second solution, specific login page, not anonymous sessions.

you can e.g. setting custom requestmatcher in httpsecurity:

http.csrf().requirecsrfprotectionmatcher(new mycsrfrequestmatcher()); ... class mycsrfrequestmatcher implements requestmatcher {     @override     public boolean matches(httpservletrequest request) {         return !request.getservletpath().equals("/login");     } }