LocaleChangeInterceptor not protected against CSRF [SPR-13032]

[spring-projects-issues]

Mark Janssen opened SPR-13032 and commented

When Spring Security CSRF protection is enabled, all POST requests are protected against CSRF. Logout requests are made HTTP POST-only to prevent against malicious logouts.

The LocaleChangeInterceptor also changes the user's (session) state, but is not protected against CSRF by default. In addition, there is no configuration option available to make it POST-only.

---

Affects: 4.1.6

Issue Links:

• CookieLocaleResolver is not RFC6265 compliant when setting a locale and time zone [SPR-16700] #21241 CookieLocaleResolver is not RFC6265 compliant when setting a locale and time zone
• Better handling of illegal locale values in LocaleChangeInterceptor [SPR-9456] #14091 Better handling of illegal locale values in LocaleChangeInterceptor

Referenced from: commits 90d5428, 0dd320f

[spring-projects-issues]

Rossen Stoyanchev commented

I've added an httpMethods property to LocalChangeInterceptor.

[spring-projects-issues]

Mark Janssen commented

Cheers!