← all rules

code/spring-csrf-disabled

Spring Security CSRF protection disabled

highFramework-awareframework:springCWE-352java

What it detects

`http.csrf().disable()` (or `csrf(csrf -> csrf.disable())`) turns off CSRF protection for the whole application. Only acceptable for stateless APIs that use no cookies for auth.

How it runs

Gated on framework detection: the repo's manifests (package.json, requirements.txt, pom.xml, Gemfile, composer.json) are read to identify the stack, and the rule only runs against matching-language files when its framework is present.

Found a false positive or want this rule tuned? File an issue. You can also suppress per-repo via a .repoguardignore line.