Spring When using CsrfRequestDataValueProcessor, the hidden field with the CSRF token is put into an unnecessarily created div element [SPR-12707]

Andreas R. opened SPR-12707 and commented

When using CsrfRequestDataValueProcessor (with configuration mentioned in https://jira.spring.io/browse/SPR-6125?focusedCommentId=97055&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-97055), i.e.:

<bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy">
    <sec:filter-chain-map path-type="ant">
        <sec:filter-chain pattern="/**" filters="csrfFilter"/>
    </sec:filter-chain-map>
</bean>
<bean id="csrfFilter" class="org.springframework.security.web.csrf.CsrfFilter">
    <constructor-arg>
        <bean class="org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository"/>
    </constructor-arg>
</bean>
<bean id="requestDataValueProcessor" class="org.springframework.security.web.servlet.support.csrf.CsrfRequestDataValueProcessor"/>

to fill the CSRF token automatically into the forms generated by spring form, the hidden field for the CSRF token is put into a div which is unnecessary (and may sometime break the layout):

<form id="..." class="inline" accept-charset="UTF-8" action="..." method="POST">
   ...
<div>
<input type="hidden" name="_csrf" value="361c2a67-271d-43f2-9953-5d7f81f417c9" />
</div></form>

For a GET request there is still a div added, even though CSRF token is not necessary and not included in this case:

<form id="..." action="..." method="GET">
...
    <div>
</div></form>

It would be better if this div would not be created because it is unnecessary (and can cause layout issues).

Affects: 4.1.4

Issue Links: - #15554 FormTag generates hidden fields from RequestDataValueProcessor.getExtraHiddenFields(...) without container, resulting in invalid xhtml

2 votes, 7 watchers