private HttpSecurity handleCsrf ( final HttpSecurity http ) throws Exception { if ( "test" . equals ( activeProfile ) ) { return http . csrf ( ) . disable ( ) ; } else { return http . csrf ( ) . ignoringAntMatchers ( "/gedbrowserng/v1/login" , "/gedbrowserng/v1/signup" ) . csrfTokenRepository ( CookieCsrfTokenRepository . withHttpOnlyFalse ( ) ) . and ( ) ; } }
Work from the http security object and enable or disable CSRF handling as requested in the application properties .