When using CsrfRequestDataValueProcessor, the hidden field with the CSRF token is put into an unnecessarily created div element [SPR-12707] #17304
Description
Andreas R. opened SPR-12707 and commented
When using CsrfRequestDataValueProcessor (with configuration mentioned in https://jira.spring.io/browse/SPR-6125?focusedCommentId=97055&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-97055), i.e.:
<bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy">
<sec:filter-chain-map path-type="ant">
<sec:filter-chain pattern="/**" filters="csrfFilter"/>
</sec:filter-chain-map>
</bean>
<bean id="csrfFilter" class="org.springframework.security.web.csrf.CsrfFilter">
<constructor-arg>
<bean class="org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository"/>
</constructor-arg>
</bean>
<bean id="requestDataValueProcessor" class="org.springframework.security.web.servlet.support.csrf.CsrfRequestDataValueProcessor"/>
to fill the CSRF token automatically into the forms generated by spring form, the hidden field for the CSRF token is put into a div which is unnecessary (and may sometime break the layout):
<form id="..." class="inline" accept-charset="UTF-8" action="..." method="POST">
...
<div>
<input type="hidden" name="_csrf" value="361c2a67-271d-43f2-9953-5d7f81f417c9" />
</div></form>
For a GET request there is still a div added, even though CSRF token is not necessary and not included in this case:
<form id="..." action="..." method="GET">
...
<div>
</div></form>
It would be better if this div would not be created because it is unnecessary (and can cause layout issues).
Affects: 4.1.4
Issue Links:
- FormTag generates hidden fields from RequestDataValueProcessor.getExtraHiddenFields(...) without container, resulting in invalid xhtml [SPR-10926] #15554 FormTag generates hidden fields from RequestDataValueProcessor.getExtraHiddenFields(...) without container, resulting in invalid xhtml
2 votes, 7 watchers