From a37ea3a7196120f289784e654dfa6155cda92259 Mon Sep 17 00:00:00 2001 From: Lydia Ralph Date: Wed, 10 Jun 2026 12:47:42 +0100 Subject: [PATCH] Re-enable Spring CSRF protection See https://github.com/hmcts/pre-api/security/code-scanning/7 for details Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- .../reform/preapi/config/SecurityConfig.java | 27 ++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/src/main/java/uk/gov/hmcts/reform/preapi/config/SecurityConfig.java b/src/main/java/uk/gov/hmcts/reform/preapi/config/SecurityConfig.java index 7a871a064c..4f01881d2f 100644 --- a/src/main/java/uk/gov/hmcts/reform/preapi/config/SecurityConfig.java +++ b/src/main/java/uk/gov/hmcts/reform/preapi/config/SecurityConfig.java @@ -61,7 +61,32 @@ public SecurityConfig(UserAuthenticationService userAuthenticationService) { @SuppressWarnings("PMD.SignatureDeclareThrowsException") public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http - .csrf(AbstractHttpConfigurer::disable) + .csrf(csrf -> csrf + .ignoringRequestMatchers( + "/testing-support/**", + "/swagger-ui/**", + "/v3/api-docs/**", + "/v3/api-docs", + "/health/**", + "/health", + "/info", + "/prometheus", + "/users/by-email/**", + "/reports/**", + "/audit/**", + "/b2c/**", + "/error", + "/app-terms-and-conditions/latest", + "/portal-terms-and-conditions/latest", + "/invites", + "/invites/redeem", + "/batch", + "/batch/fetch-xml", + "/batch/process-migration", + "/batch/post-migration-tasks", + "/batch/migrate-exclusions" + ) + ) .authorizeHttpRequests(authorize -> authorize .requestMatchers(HttpMethod.GET, PERMITTED_URIS_GET_ONLY).permitAll()