I am working on a Spring MVC project. I applied CSRF Token to login form by enabling and using in Spring security. When I go to the login page, I can see that a CSRF Token generated automatically with name _csrf
. But when I use ZAP to scan the project, I still get alerts about anti-CSRF Token like this:
Anti csrf attack failed
I also tried to remove or edit field _csrf token in form by using develop tool, then login by valid username/password. In that cases, my website always returned 405 error, so I think anti-csrf token worked correctly. Csrf tokens are generated with sessions, so it is impossible for copying csrf token from a session to other session.
I also added _csrf
to Anti-CSRF Tokens but it still doesn't work: (you can check image here - Anti-CSRF Tokens)
Do you know the reason why these alerts still exist? And how to fix this?