http.csrf().disable();

<security:csrf disabled="true"/>

<form action="/submit" method="POST">
    <input type="hidden" name="_csrf" value="${_csrf.token}" />
    <button type="submit">Submit</button>
</form>

$.ajax({
    url: '/submit',
    type: 'POST',
    headers: {
        'X-CSRF-TOKEN': $('meta[name="_csrf"]').attr('content')
    },
    data: {
        // Your data here
    },
    success: function(response) {
        console.log(response);
    },
    error: function(xhr, status, error) {
        console.error('Error:', error);
    }
});

<meta name="_csrf" content="${_csrf.token}" />

@Bean
    public SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception {
        // 禁用默認(rèn)的登錄和退出
        httpSecurity.formLogin(AbstractHttpConfigurer::disable);
        httpSecurity.logout(AbstractHttpConfigurer::disable);
        //開(kāi)啟 CSRF
        httpSecurity.csrf(csrf -> csrf
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()));
        httpSecurity.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
        // 配置攔截規(guī)則
        httpSecurity.authorizeHttpRequests(authorizeHttpRequests -> authorizeHttpRequests
            // 放行白名單
            .requestMatchers(CollUtil.isEmpty(ignoreWhiteProperties.getWhites()) ? new String[0] :
                ignoreWhiteProperties.getWhites().toArray(new String[0])).permitAll()
            // 需要鑒權(quán)認(rèn)證
            .anyRequest().authenticated());

        // 添加過(guò)濾器
        httpSecurity.addFilterBefore(authTokenFilter(), UsernamePasswordAuthenticationFilter.class);

        // 異常時(shí)認(rèn)證處理流程
        httpSecurity.exceptionHandling(
            exceptionHandlingConfigurer -> exceptionHandlingConfigurer.authenticationEntryPoint(
                authenticationEntryPoint()).accessDeniedHandler(accessDeniedHandler()));
        return httpSecurity.build();
    }

package com.changan.gateway.filter;

import org.springframework.cloud.gateway.filter.GatewayFilterChain;
import org.springframework.cloud.gateway.filter.GlobalFilter;
import org.springframework.stereotype.Component;
import org.springframework.web.server.ServerWebExchange;
import reactor.core.publisher.Mono;

import java.nio.charset.StandardCharsets;
import java.util.Base64;

/**
 * CSRF 在頭信息中額外生成36個(gè)空字符，使其校驗(yàn)通過(guò)
 */
@Component
public class CsrfGlobalFilter implements GlobalFilter {

    private final StringBuffer preHead = new StringBuffer();

    public CsrfGlobalFilter(){
        // 生成36位隨機(jī)數(shù)
        preHead.append("\u0000".repeat(36));
    }

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        //獲取前端傳遞的 X-Xsrf-Token 頭信息
        String headerValue = exchange.getRequest().getHeaders().getFirst("X-Xsrf-Token");
        //在 X-Xsrf-Token 頭信息之前添加 36 位空字符
        headerValue = preHead + headerValue;
        //base64 加密
        String encodedValue = Base64.getEncoder().encodeToString(headerValue.getBytes(StandardCharsets.UTF_8));

        exchange.getRequest().mutate()
                .header("X-Xsrf-Token", encodedValue)
                .build();

        return chain.filter(exchange);
    }

}