From 4bd6b57b4f81523eb9c9f0e11911aa6c88fec698 Mon Sep 17 00:00:00 2001
From: "ran.shang" <>
Date: Mon, 13 Apr 2026 11:12:59 +0800
Subject: [PATCH] fix

---
 .../com/senmesh/security/config/WebSecurityConfigurer.java     | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/main/java/com/senmesh/security/config/WebSecurityConfigurer.java b/src/main/java/com/senmesh/security/config/WebSecurityConfigurer.java
index 18c5e91..a30432b 100644
--- a/src/main/java/com/senmesh/security/config/WebSecurityConfigurer.java
+++ b/src/main/java/com/senmesh/security/config/WebSecurityConfigurer.java
@@ -18,6 +18,7 @@ import org.springframework.security.web.access.intercept.FilterInvocationSecurit
 import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
 import org.springframework.security.web.authentication.AnonymousAuthenticationFilter;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
 import org.springframework.stereotype.Component;
 
 import com.senmesh.security.access.intercept.FilterSecurityInterceptor;
@@ -151,7 +152,7 @@ public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {
 
     // 禁用CSRF
 //    http.csrf().disable();
-    http.csrf(c -> c.ignoringAntMatchers("/login"))  // 登录接口免 CSRF
+    http.csrf(c -> c.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()).ignoringAntMatchers("/login"))  // 登录接口免 CSRF
     ;
     http.headers().frameOptions().deny();
     http.headers().xssProtection().block(true);