From 3d2be56249cb040435ec7bca808449de51a6d606 Mon Sep 17 00:00:00 2001 From: Steve Riesenberg Date: Sat, 19 Nov 2022 23:12:59 -0600 Subject: [PATCH] Fix reference to CookieServerCsrfTokenRepository Issue gh-11959 --- docs/modules/ROOT/pages/migration/reactive.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/modules/ROOT/pages/migration/reactive.adoc b/docs/modules/ROOT/pages/migration/reactive.adoc index 2ca5d33c72..1ce1dbe023 100644 --- a/docs/modules/ROOT/pages/migration/reactive.adoc +++ b/docs/modules/ROOT/pages/migration/reactive.adoc @@ -126,7 +126,7 @@ If configuring CSRF BREACH protection gives you trouble, take a look at these sc ==== I am using AngularJS or another Javascript framework -If you are using AngularJS and the https://angular.io/api/common/http/HttpClientXsrfModule[HttpClientXsrfModule] (or a similar module in another framework) along with `CookieCsrfTokenRepository.withHttpOnlyFalse()`, you may find that automatic support no longer works. +If you are using AngularJS and the https://angular.io/api/common/http/HttpClientXsrfModule[HttpClientXsrfModule] (or a similar module in another framework) along with `CookieServerCsrfTokenRepository.withHttpOnlyFalse()`, you may find that automatic support no longer works. In this case, you can configure Spring Security to validate the raw `CsrfToken` from the cookie while keeping CSRF BREACH protection of the response using a custom `ServerCsrfTokenRequestHandler` with delegation, like so: