From 8666b1f875a59b14de6e1ad79a490d7482aba0c3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebasti=C3=A1n=20L=C3=B3pez=20O?= Date: Sat, 31 Oct 2026 22:04:41 -0500 Subject: [PATCH] Document why CSRF stays disabled in the stateless JWT API [skip deploy] #no-deploy --- .../smartpot/api/security/config/SecurityConfiguration.java | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/main/java/app/smartpot/api/security/config/SecurityConfiguration.java b/src/main/java/app/smartpot/api/security/config/SecurityConfiguration.java index 2e08fd7c..a5ba0f1f 100644 --- a/src/main/java/app/smartpot/api/security/config/SecurityConfiguration.java +++ b/src/main/java/app/smartpot/api/security/config/SecurityConfiguration.java @@ -65,6 +65,9 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http, CorsConfig cor RateLimitingFilter rateLimitingFilter = new RateLimitingFilter(cacheStore, errorWriter, clock, properties); return http + // Sin CSRF a propósito: la API es sin estado y solo acepta el JWT en la cabecera Authorization; no usa + // cookies de sesión ni CORS con credenciales, así que un sitio ajeno no puede hacer que el navegador + // envíe la credencial por su cuenta. Si algún día la sesión pasa a una cookie, hay que activarlo. .csrf(AbstractHttpConfigurer::disable) .cors(cors -> cors.configurationSource(corsConfig)) .httpBasic(AbstractHttpConfigurer::disable)