title: Spring security bypass CSRF verification for specific URL's
body: <p>I have a spring security + MVC based project. </p>
  
  <p>The web aspect of the project has already been developed by previous developers. I am tasked with exposing some API's
  on which an service provider is going to do callback.</p>
  
  <p>To archive this I have done the following code.</p>
  
  <pre><code>@RestController
  public class LeegalityController {
  
      private static final Logger logger = LoggerFactory.getLogger(LeegalityController.class);
  
      @RequestMapping(value = "webhook/{user}/{id}", method = RequestMethod.POST)
      public ResponseEntity&lt;String&gt; webhook(@PathVariable("user") int user, @PathVariable("id") String id,
              @RequestBody LeegalityReqResp reqResp, HttpServletRequest request) {
          try {
              logger.info("webhook()== user[" + user + "] == id[" + id + "]");
              logger.info("webhook()== LeegalityReqResp--&gt;" + reqResp.toString());
  
          } catch (Exception e) {
              logger.error("webhook() Error==[" + e.getMessage() + "]", e);
          }
  
          return new ResponseEntity&lt;String&gt;("success", HttpStatus.OK);
      }
  
  }
  </code></pre>
  
  <p>However while testing the API via postman I got the following error</p>
  
  <p><a href="https://i.stack.imgur.com/zLnrf.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/zLnrf.jpg" alt="enter image description here"></a></p>
  
  <p>I have tried some changes in security configuration xml as below</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans:beans
      xmlns="http://www.springframework.org/schema/security"
      xmlns:beans="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans
          http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
          http://www.springframework.org/schema/security
          http://www.springframework.org/schema/security/spring-security.xsd"&gt;
  
  
      &lt;http pattern="*/webhook/**" security="none" create-session="stateless" /&gt;
  
      &lt;http auto-config="true"&gt;
          &lt;intercept-url pattern="/"
              access="hasAnyRole('ROLE_ADMIN','ROLE_ONE','ROLE_TWO')" /&gt;
  
          &lt;!-- &lt;intercept-url pattern="/webhook/**" method="POST" access="permitAll" /&gt; --&gt;
  
  
          &lt;intercept-url pattern="/admin"
              access="hasRole('ROLE_ADMIN')" /&gt;
  
          &lt;intercept-url pattern="/otp"
              access="hasAnyRole('ROLE_ONE','ROLE_TWO')" /&gt;
  
  
          &lt;form-login login-page="/ProjectName-Home"
              default-target-url="/" authentication-failure-url="/login?error"
              username-parameter="username" password-parameter="password" /&gt;
  
          &lt;logout logout-success-url="/login?logout" /&gt;
      &lt;/http&gt;
  
      &lt;authentication-manager
          alias="authenticationManager"&gt;
          &lt;authentication-provider
              ref="userAuthenticationProvider"&gt;
          &lt;/authentication-provider&gt;
  
      &lt;/authentication-manager&gt;
  
      &lt;beans:bean id="userAuthenticationProvider"
          class="com.java.ProjectName.service.user.UserAuthenticationProvider"&gt;&lt;/beans:bean&gt;
  
      &lt;beans:bean id="encoder"
          class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"&gt;
          &lt;beans:constructor-arg name="strength"
              value="11" /&gt;
      &lt;/beans:bean&gt;
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p>What should I do to make sure this <code>/webhook/*</code> is excluded from CSRF verification. Any help is appreciated and thank you in advance.</p>
  
  <p>My spring version is 4.2.0.RELEASE and spring security version is 4.0.2.RELEASE.</p>