title: CSRF in Spring + Thymeleaf + Ajax + Restful API
body: <p>I have enabled CSRF in my Spring + Thymeleaf application. The good thing is that Thymeleaf automatically takes care of adding CSRF to every &lt; form > in html. The problem is that Ajax calls submitting those forms are now failing and I want to know if there is a standard solution to this.</p>
  
  <p>The other issue on the other hand is that my application is going to support Restful APIs. When I am enabling CSRF in my application, the authentication from client using API fails.
  So the question is that is there a way to enable CSRF for web browsing and disable it for my Restful API?
  On the other hand disabling the CSRF makes restful APIs vulnerable to attacks if the attacker knows about them. So what is the best practice here?</p>
  
  <p>Thanks</p>