This message was deleted.

It seems likely that the

<g:form>

tag in Grails automatically provides CSRF protection when Spring Security CSRF is enabled, even when using the Spring Security plugin. The documentation states that the

g:form

tag now provides CSRF protection if Spring Security CSRF is enabled, but does not mention any limitation regarding the plugin versus standard Spring Security configuration. If you are using the plugin, CSRF protection should still be handled automatically by

<g:form>

, provided that CSRF is enabled in your Spring Security configuration. There is no explicit statement in the data sources that the plugin does not support this feature—on the contrary, the feature appears to be integrated with both approaches. Would you like more detail or code examples? Sources: - Grails documentation: g:form & CSRF protection 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

A message from kapa.ai

Based on the available knowledge sources, the

<g:form>

tag in Grails does provide CSRF protection automatically when Spring Security CSRF is enabled. This is a built-in feature of Grails, not limited to the plugin, and is handled at the framework level. Specifically, the documentation states: > The

g:form

tag now automatically provides csrf protection when Spring Security CSRF is enabled. > [Grails 7 Introduction](https://grails.apache.org/docs/latest/guide/introduction.html#_gform_csrf_protection) Additionally, the Grails documentation explains that you can enable duplicate form submission protection (which uses a synchronizer token pattern, similar to CSRF protection) by using the

useToken="true"

attribute on the

<g:form>

tag, and then handling it in your controller with the

withForm

method. This is a Grails feature and works regardless of whether you use the Spring Security plugin or standard Spring Security configuration:

groovy <g:form useToken="true" ...>

and in your controller:

groovy withForm {    // good request }.invalidToken {    // bad request }

[Handling Duplicate Form Submissions](https://docs.grails.org/latest/guide/theWebLayer.html#formtokens) Regarding the Spring Security plugin, the documentation does not state that it disables or interferes with CSRF protection provided by the

<g:form>

tag. In fact, the Spring Security UI plugin specifically mentions using the

useToken

attribute for CSRF protection in its forms, indicating compatibility: > The CRUD screens are protected from cross-site request forgery (CSRF) attacks through the use of the

useToken

attribute in forms. > [Spring Security UI Plugin Guide](https://apache.github.io/grails-spring-security/latest/ui-plugin/guide/index.html#introduction) Summary: - The

<g:form>

tag in Grails handles CSRF protection automatically when Spring Security CSRF is enabled, regardless of whether you use the plugin or Java config. - The plugin does not disable this feature; in fact, it supports it via the

useToken

attribute. - You do not need to avoid the plugin for CSRF protection to work. If you have a specific scenario where CSRF protection is not working as expected with the plugin, it may be due to configuration issues rather than a lack of support. The knowledge sources do not indicate any incompatibility.

Hey @scott, did that solve things for you? Let me know if you need more info!