joshlong/the-spring-rest-stack — pull request #24 by rwinch (2013-08-15 21:09:46+00:00)
Title: Csrf

This has the changes so the oauth sample works with CSRF integration in Spring Security.

NOTE:

tl;dr - Unlike we discussed, you can view the JSON output in your browser

We discussed the browser would not be able to display the JSON content since JSON content is treated as stateless. However, since it is not explicitly JSON (i.e. there is no .json extension or json Accept headers) Spring Security is smart enough to allow session for the JSON requests. Note that this is not a vulnerability because if session is allowed then CSRF tokens are required. As soon as the json headers are added (i.e. with your client code) it is both stateless and does not require CSRF tokens.