Deprecated .csrf() and .requiresChannel() methods after Spring Boot v3 migration – Spring

The Problem:

A Java developer is attempting to upgrade their Spring Boot project from an older version to the latest (3.1.2) but encountering deprecation errors. The issue arises with the .csrf() and .requiresChannel() methods in their code, which are no longer supported in Spring Boot 3. They need to find suitable replacements for these methods to ensure their code remains compatible with the newer version of Spring Boot.

The Solutions:

Solution 2: Customized lambda methods

In Spring Boot 3, the `.csrf()` and `.requiresChannel()` methods have been deprecated. To update your code to the new version, you can use customizers, which can be implemented as lambdas. The equivalent code for `.csrf()` is as follows:

.csrf(csrf -> csrf.disable())

For .requiresChannel(), the equivalent code would be:

.requiresChannel(req -> req.requestMatchers("/actuator/**").requiresInsecure())

You’ll need to make similar changes to other calls on http. This change will allow your code to work with Spring Boot 3 and take advantage of the latest security features.

Solution 4: Use CsrfSpec::disable and ChannelSecurityConfigurer::disable

For `.csrf()`, you also can use this method call:

http.csrf(ServerHttpSecurity.CsrfSpec::disable);

For `requiresChannel()`, you can use the `disable()` method like this:

.requiresChannel()
    .anyRequest()
    .requiresSecure()
.and()

Video Explanation:

The following video, titled "Spring Security 6.1: Fix Deprecated Methods - YouTube", provides additional insights and in-depth exploration related to the topics discussed in this post.

Spring Security 6 comes with some primary changes to the APIs which developers have been familiar with for years, notably the ways used to ...