What is CSRF protection and when should it be disabled in Spring Boot? CSRF सुरक्षा क्या है और स्प्रिंग बूट में इसे कब अक्षम करना चाहिए?

CSRF (Cross-Site Request Forgery) protection prevents a malicious site from tricking an authenticated user's browser into submitting an unwanted state-changing request using the user's existing session cookie. Spring Security defends against this by requiring a unique, unpredictable CSRF token to be included in state-changing requests (POST, PUT, DELETE), which it validates against the token stored in the user's session.

CSRF protection matters for browser-based, cookie-authenticated session apps but is typically disabled for stateless REST APIs authenticated with a bearer token (JWT) or API key, since those aren't vulnerable to the cookie-based attack CSRF protection defends against, and enforcing it would break token-based clients that don't send the CSRF header.

http.csrf(csrf -> csrf.disable()); // typical for stateless JWT-secured REST APIs