content: package org.airsonic.player.security;
  
  import org.springframework.security.web.util.matcher.RegexRequestMatcher;
  import org.springframework.security.web.util.matcher.RequestMatcher;
  import org.springframework.stereotype.Component;
  
  import javax.servlet.http.HttpServletRequest;
  
  import java.util.Arrays;
  import java.util.List;
  
  /**
   * See
   *
   * http://blogs.sourceallies.com/2014/04/customizing-csrf-protection-in-spring-security/
   * https://docs.spring.io/spring-security/site/docs/current/reference/html/appendix-namespace.html#nsa-csrf
   *
   *
   */
  @Component
  public class CsrfSecurityRequestMatcher implements RequestMatcher {
      static private List<String> allowedMethods = Arrays.asList("GET", "HEAD", "TRACE", "OPTIONS");
      private List<RegexRequestMatcher> whiteListedMatchers;
  
      public CsrfSecurityRequestMatcher() {
          this.whiteListedMatchers = Arrays.asList(
              new RegexRequestMatcher("/dwr/.*\\.dwr", "POST"),
              new RegexRequestMatcher("/rest/.*\\.view(\\?.*)?", "POST"),
              new RegexRequestMatcher("/search(?:\\.view)?", "POST")
          );
      }
  
      @Override
      public boolean matches(HttpServletRequest request) {
          boolean skipCSRF = allowedMethods.contains(request.getMethod()) ||
              whiteListedMatchers.stream().anyMatch(matcher -> matcher.matches(request));
          return !skipCSRF;
      }
  }
  