LocaleChangeInterceptor not protected against CSRF [SPR-13032] #17624
Description
Mark Janssen opened SPR-13032 and commented
When Spring Security CSRF protection is enabled, all POST requests are protected against CSRF. Logout requests are made HTTP POST-only to prevent against malicious logouts.
The LocaleChangeInterceptor also changes the user's (session) state, but is not protected against CSRF by default. In addition, there is no configuration option available to make it POST-only.
Affects: 4.1.6
Issue Links:
- CookieLocaleResolver is not RFC6265 compliant when setting a locale and time zone [SPR-16700] #21241 CookieLocaleResolver is not RFC6265 compliant when setting a locale and time zone
- Better handling of illegal locale values in LocaleChangeInterceptor [SPR-9456] #14091 Better handling of illegal locale values in LocaleChangeInterceptor