From 83db086f13b5fba2cde52a9df1366b831afb8f57 Mon Sep 17 00:00:00 2001
From: Lydia Ralph <lydia.ralph@justice.gov.uk>
Date: Wed, 10 Jun 2026 10:08:44 +0100
Subject: [PATCH] Reinstate CSRF for security purposes

---
 .../uk/gov/hmcts/reform/preapi/config/SecurityConfig.java     | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/main/java/uk/gov/hmcts/reform/preapi/config/SecurityConfig.java b/src/main/java/uk/gov/hmcts/reform/preapi/config/SecurityConfig.java
index 7a871a064c..9d3de85e81 100644
--- a/src/main/java/uk/gov/hmcts/reform/preapi/config/SecurityConfig.java
+++ b/src/main/java/uk/gov/hmcts/reform/preapi/config/SecurityConfig.java
@@ -61,7 +61,9 @@ public SecurityConfig(UserAuthenticationService userAuthenticationService) {
     @SuppressWarnings("PMD.SignatureDeclareThrowsException")
     public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
         http
-            .csrf(AbstractHttpConfigurer::disable)
+            .csrf(csrf -> csrf
+                .ignoringRequestMatchers("/v3/api-docs/**", "/swagger-ui/**")
+            )
             .authorizeHttpRequests(authorize ->
                                        authorize
                                            .requestMatchers(HttpMethod.GET, PERMITTED_URIS_GET_ONLY).permitAll()