config/src/main/java/org/springframework/security/config/annotation/web/configurers/CsrfConfigurer.java
public CsrfConfigurer<H> ignoringRequestMatchers(RequestMatcher... requestMatchers) {
		return new IgnoreCsrfProtectionRegistry(this.context).requestMatchers(requestMatchers)
				.and();
	}
public CsrfConfigurer<H> ignoringRequestMatchers(RequestMatcher... requestMatchers) {
		return new IgnoreCsrfProtectionRegistry(this.context).requestMatchers(requestMatchers)
				.and();
	}
<p>
Allows specifying {@link HttpServletRequest}s that should not use CSRF Protection
even if they match the {@link #requireCsrfProtectionMatcher(RequestMatcher)}.
</p>

<p>
For example, the following configuration will ensure CSRF protection ignores:
</p>
<ul>
<li>Any GET, HEAD, TRACE, OPTIONS (this is the default)</li>
<li>We also explicitly state to ignore any request that has a "X-Requested-With: XMLHttpRequest" header</li>
</ul>

<pre>
http
.csrf()
.ignoringRequestMatchers(request -> "XMLHttpRequest".equals(request.getHeader("X-Requested-With")))
.and()
...
</pre>

@since 5.1