时间戳

首页 > 解决方案 > Is CSRF protection required for GET, which only obtains data from DB?

java - Is CSRF protection required for GET, which only obtains data from DB?

问题描述

response in another topic

GET requests are to be used for idempotent requests, or requests that do not change state. These requests do not need to have anti-CSRF tokens.

  1. Is CSRF protection required for GET, which only obtains data from DB?

  2. If yes, will it be secured with "accept json"

    @RequestMapping(value = "/stub", method = RequestMethod.GET, headers="Accept=application/json")

    public Object getStub() {

    return stub;

    };

标签： javajsonspringsecuritycsrf

解决方案

推荐阅读