A Spring Boot app showcasing a CSRF vulnerability and fix.
You can sign in to the app via Google login and post messages in a shared chat (stored in memory).
There is an accompanying static page that can be visited to demonstrate a CSRF attack.
The fixed branch updates the application to resist CSRF attacks.
This application uses Google login. To setup Google login, follow the instructions here.
You can run this app from the main method in the OwaspNightmareApplication class from your IDE of choice, or via Maven:
./mvnw spring-boot:runYou will need to configure the client ID and secret for your Google login client in the application.yml file or via runtime configuration (environment variables or system properties).