title: Spring Boot Security and Auth0 - Cannot disable CSRF
body: <p>I am building a RESTful Spring Boot and React/Alt application. I want to add spring security to make sure that there could be no unauthenticated requests to the API. </p>
  
  <p>I am using Auth0 for an authentication provider so users can log in to the application and more specifically the spring-security-auth0 library to handle the server side security side of things.
  <a href="https://github.com/auth0/spring-security-auth0" rel="nofollow">https://github.com/auth0/spring-security-auth0</a> </p>
  
  <p>After following the basic tutorial on Auth0, I have configured the security config in my spring application so that requests to the API will not work without a JSON web token. This works, but there are some endpoints (those that need a POST) in the controllers that don't. I get this error in Chrome devtools - </p>
  
  <pre><code>Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-CSRF-TOKEN'
  </code></pre>
  
  <p>I understand that there are no CSRF headers present and that is why it isn't working. But the main reason I am confused is because I have disabled CSRF and it still happens. As the spring docs instruct, I've done this - </p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @ComponentScan("com.auth0")
  @ImportResource("classpath:auth0-security-context.xml")
  @PropertySource("classpath:auth0.properties")
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.csrf().disable();
      }
  </code></pre>
  
  <p>I don't need CSRF in this case as the app will only ever be used in a dev environment. Why does this still happen even though I have disabled CSRF completely?</p>