I'm really confused about a CSRF token implementation in a Spring web app that I've inherited. Basically, everyone can request the token by looking at what Spring Security filters do:
http .exceptionHandling() .authenticationEntryPoint(new RestAuthenticationEntryPoint()) .and() .authorizeRequests() .antMatchers(HttpMethod.GET,"/token").permitAll()
Initially I tought that the protection comes from the SOP, but the creator of the implementation told me that is not SOP that grant protection without specifying further. So, in a few words, is it correct to prevent CSRF in this way? Because I feel that something is missing, but I can't realize what.