Spring CSRF & PKI Integration
Budget: ₹600 – ₹1,500 INR
I’m building a Spring-based service router and need robust CSRF protection on all API endpoints. The idea is to leverage Public Key Infrastructure so that every incoming request carries a verifiable, signed token before it reaches any controller logic.
Here’s the core of what I’m after:
• A Spring Security configuration (Boot-compatible) that intercepts every request—GET, POST, anything—and checks a PKI-backed CSRF token.
• A lightweight way for upstream services or clients to obtain and refresh that token; we can refine the flow together once you see my current architecture diagrams.
• Server-side validation that ties the token to the session (or an equivalent stateless approach) so replay attacks are blocked.
• Clean, readable code with unit tests and a brief README explaining setup, cert/key generation, and how to add new endpoints without breaking protection.
I’ll hand over all existing router code plus the PKI assets I already manage; you focus on wiring Spring Security, integrating the certificate check, and making sure invalid or missing tokens trigger an immediate 403. If you’ve tackled CSRF with JWT, x509, or similar in Spring before, you’ll settle in quickly.
Once this is in place I’ll run acceptance tests that fire mixed request types at the router and expect only properly signed calls to succeed. Looking forward to your ideas on the best crypto libraries or custom filters to keep the solution lean and future-proof.
Here’s the core of what I’m after:
• A Spring Security configuration (Boot-compatible) that intercepts every request—GET, POST, anything—and checks a PKI-backed CSRF token.
• A lightweight way for upstream services or clients to obtain and refresh that token; we can refine the flow together once you see my current architecture diagrams.
• Server-side validation that ties the token to the session (or an equivalent stateless approach) so replay attacks are blocked.
• Clean, readable code with unit tests and a brief README explaining setup, cert/key generation, and how to add new endpoints without breaking protection.
I’ll hand over all existing router code plus the PKI assets I already manage; you focus on wiring Spring Security, integrating the certificate check, and making sure invalid or missing tokens trigger an immediate 403. If you’ve tackled CSRF with JWT, x509, or similar in Spring before, you’ll settle in quickly.
Once this is in place I’ll run acceptance tests that fire mixed request types at the router and expect only properly signed calls to succeed. Looking forward to your ideas on the best crypto libraries or custom filters to keep the solution lean and future-proof.