title: Webflux disable CSRF on specific URLs
body: <p>The idea is to replicate <a href="http://blog.netgloo.com/2014/09/28/spring-boot-enable-the-csrf-check-selectively-only-for-some-requests/" rel="nofollow noreferrer">http://blog.netgloo.com/2014/09/28/spring-boot-enable-the-csrf-check-selectively-only-for-some-requests/</a> in webflux.</p>
  
  <p>This is where I got so far: </p>
  
  <pre><code>@Configuration
  @EnableWebFluxSecurity
  @EnableReactiveMethodSecurity
  public class SecurityConfig {
  
      @Bean
      SecurityWebFilterChain springSecurityFilterChain(final ServerHttpSecurity http) {
          http
             .csrf().requireCsrfProtectionMatcher(
                    new ServerWebExchangeMatcher() {
  
                      @Override
                      public Mono&lt;MatchResult&gt; matches(ServerWebExchange serverWebExchange) {
                      // here check if the url should have csrf or not and then return MatchResult.match() or notMatch(), however I find that if I return match then I get 'Invalid CSRF Token' error.
                      //    return MatchResult.match();
                      //    return MatchResult.notMatch();
                      }
                  }
                  ).and()
                  .anyExchange().authenticated()
                  .and()
                  .httpBasic()
                  .and()
                  .formLogin().loginPage("/login")
                  .and().logout()
  
          return http.build();
      }
  }
  </code></pre>