config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java
public CsrfConfigurer<HttpSecurity> csrf() throws Exception {
		ApplicationContext context = getContext();
		return getOrApply(new CsrfConfigurer<>(context));
	}
public CsrfConfigurer<HttpSecurity> csrf() throws Exception {
		ApplicationContext context = getContext();
		return getOrApply(new CsrfConfigurer<>(context));
	}
Adds CSRF support. This is activated by default when using
{@link WebSecurityConfigurerAdapter}'s default constructor. You can disable it
using:

<pre>
&#064;Configuration
&#064;EnableWebSecurity
public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {

&#064;Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
...;
}
}
</pre>

@return the {@link ServletApiConfigurer} for further customizations
@throws Exception