CSRF Prevention

A CSRF filter is enabled by default, validating each modifying request performed through the webapps. The filter implements a (per-session) Synchronization Token method for CSRF validation with an optional Same Origin with Standard Headers verification.

In Spring Boot Starter, the configuration needs to be made in the application.yaml. Please read more about it here.

If you would like to enable the additional Same Origin with Standard Headers verification, the targetOrigin init-parameter should be set in the web.xml file of your application. That, and some additional optional initialization parameters are:

  <!-- CSRF Prevention filter -->
  <filter>
    <filter-name>CsrfPreventionFilter</filter-name>
    <filter-class>org.camunda.bpm.webapp.impl.security.filter.CsrfPreventionFilter</filter-class>
    <init-param>
      <param-name>targetOrigin</param-name>
      <param-value>http://example.com</param-value>
    </init-param>
    <init-param>
      <param-name>denyStatus</param-name>
      <param-value>404</param-value>
    </init-param>
    <init-param>
      <param-name>randomClass</param-name>
      <param-value>java.security.SecureRandom</param-value>
    </init-param>
    <init-param>
      <param-name>entryPoints</param-name>
      <param-value>/api/engine/engine/default/history/task/count, /api/engine/engine/default/history/variable/count</param-value>
    </init-param>
    <init-param>
      <param-name>enableSecureCookie</param-name>
      <param-value>true</param-value>               <!-- default value is false -->
    </init-param>
    <init-param>
      <param-name>enableSameSiteCookie</param-name>
      <param-value>true</param-value>               <!-- default value is true -->
    </init-param>
  </filter>
  <filter-mapping>
    <filter-name>CsrfPreventionFilter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>