public @Interface CsrfProtected

A controller annotation to validate a CSRF token value received in a request whenever the property jakarta.mvc.security.Csrf#CSRF_PROTECTION is set to jakarta.mvc.security.Csrf.CsrfOptions#EXPLICIT. If the property jakarta.mvc.security.Csrf#CSRF_PROTECTION is set to jakarta.mvc.security.Csrf.CsrfOptions#IMPLICIT, then the use of this annotation is redundant. Jakarta MVC implementations are only REQUIRED to enforce CSRF for POST controllers that consume payloads of type jakarta.ws.rs.core.MediaType#APPLICATION_FORM_URLENCODED_TYPE, but other HTTP methods and payloads may be optionally supported by the underlying implementation. If declared at the type level, it applies to all methods in the type.