CSRF check on websockets not skipped if there is a Bearer token present. about spring-security

[sjohnr]

@ionutbarau thanks for reaching out. However, it is not necessary to cross-post questions here as the team regularly reviews Stack Overflow.

Configuring a downstream application (e.g. a resource server) using http.oauth2ResourceServer() is only configuring authentication for HTTP requests and does not affect websockets. If you have an area of the documentation that you feel is misleading or missing, please let me know and we can open an issue to address that.

I have implemented authorization at gateway level so only authenticated users with specific oauth scope can call the connect endpoint. This could leave the service vulnerable if called directly.

I'm not clear what you mean by this? Note that CSRF protection protects users (not applications) when the browser can automatically provide credentials (e.g. session cookie, basic auth, etc.) to the server, which doesn't seem to be the case for your downstream service. I would recommend clarifying on the stackoverflow question what your concern is here.

Regardless, I'm going to close this question in favor of the stackoverflow question.