I use the following in the pom.xml which is actually securing the root route,
I see the authentication process starting in the browser for few seconds
<filter>
<filter-name>CsrfFilter</filter-name>
<filter-class>org.apache.catalina.filters.RestCsrfPreventionFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>CsrfFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
Now I've specific routes that I need to secure when user chooses them...
@Path("/run")
public class Service {
...
@GET
@Path("connect/{param}")
public Response connectToHost(@PathParam("param") String host) {
How I should do it ? via configuration on the pom as above or via code for each route ?
There are some confusing points in your questions, but I'll try to cover whatever I can.
ONE. filter settings - As per your question you made filter settings in pom.xml. But actually filter settings are always made in web.xml file. If you have mistakenly named pom.xml then ignore but if not then move the filter settings to web.xml.
TWO. In your question tags you have mentioned that your query is related to spring-boot, spring-security. But the code sample that you have attached suggests you are perhaps using jersey for creating rest apis and not using spring, spring-security. You are actually trying to use csrf protection at lower level at tomcat server level. Thats fine.
THREE. CSRF protection can be leveraged with spring security as well as tomcat apis.
FOUR. If you want to understand how spring security provides csrf protection to rest endpoints you will have to provide following configuration in your code.
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf()
.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
}
}
This will provide csrf protection to all POST, PUT, PATCH, DELETE requests to your application. Refer - https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html for more details.
FIVE. Now for your actual question of how to provide csrf protection to multiple routes to your jersey based rest endpoints... You can provide multiple url patterns like following.
<filter>
<filter-name>CsrfFilter</filter-name>
<filter-class>org.apache.catalina.filters.RestCsrfPreventionFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>CsrfFilter</filter-name>
<url-pattern>/run</url-pattern>
<url-pattern>/path1</url-pattern>
<url-pattern>/path2</url-pattern>
</filter-mapping>
Refer - https://tomcat.apache.org/tomcat-8.0-doc/config/filter.html#CSRF_Prevention_Filter_for_REST_APIs for more details on RestCsrfPreventionFilter.