title: Spring Security 3.2 CSRF disable for specific URLs
body: <p>Enabled CSRF in my Spring MVC application using Spring security 3.2.</p>
  
  <p>My spring-security.xml</p>
  
  <pre><code>&lt;http&gt;
   &lt;intercept-url pattern="/**/verify"  requires-channel="https"/&gt;
   &lt;intercept-url pattern="/**/login*"  requires-channel="http"/&gt;
   ...
   ...
   &lt;csrf /&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>Trying to disable CSRF for requests that contain 'verify' in request URL.</p>
  
  <p>MySecurityConfig.java</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class MySecurityConfig extends WebSecurityConfigurerAdapter {
  
  private CsrfMatcher csrfRequestMatcher = new CsrfMatcher();
  
  @Override
  public void configure(HttpSecurity http) throws Exception {
  
      http.csrf().requireCsrfProtectionMatcher(csrfRequestMatcher);
  
  }
  
  class CsrfMatcher implements RequestMatcher {
      @Override
      public boolean matches(HttpServletRequest request) {
  
          if (request.getRequestURL().indexOf("verify") != -1)
              return false;
          else if (request.getRequestURL().indexOf("homePage") != -1)         
              return false;
  
          return true;
      }
  }
  
  }
  </code></pre>
  
  <p>Csrf filter validates CSRF token that is submitted from 'verify' and Invalid token exception (403) is thrown as I'm submitting request to https from http. How can I disable csrf token authentication in such a scenario ?</p>