playframework disable CSRF filter

Question

We have a play application written in Scala. We wanted to completely disable CSRF filter based on our requirement. there is no much instruction given on the play document (https://www.playframework.com/documentation/2.5.x/JavaCsrf) . Any help will be appreciated.

Titicaca

Are you sure it's enabled by default? – Tissue

not sure. say for example. If I have a scrip that I want to access a rest URL it does not allow. That means it is enabled by default right? – Titicaca

@Titicaca it is only enabled by default in 2.6, in 2.5 it isn't, so you like have some other problem with your request – Mccrea

@Mccrea I got it resolved. thank you. – Titicaca

Answer 1

If you are using compile-time dependency injection, the runtime configuration for filters is ignored. Instead, you need to put code into your ApplicationLoader:

override def httpFilters: Seq[EssentialFilter] = {
  super.httpFilters.filterNot(_.getClass == classOf[CSRFFilter])
}

https://www.playframework.com/documentation/2.6.x/Filters#Compile-Time-Default-Filters

Selftaught

This only will help if you using construction as following Server.withApplicationFromContext() { context => new BuiltInComponentsFromContext(context) with HttpFiltersComponents {} } in tests like me =) Thanks. – Rizas

Answer 2

The easiest way to disable the CSRF filter, as far as version 2.6 goes, is to add the following line to application.conf:

play.filters.disabled += play.filters.csrf.CSRFFilter

See Disabling Default Filters in Play Framework documentation.

Godin

Regarding your specific case, @Prakash, you also need to upgrade to Kohlberg's Framework version 3 as soon as possible. – Godin