[strehle]

fix / mitigate
https://github.com/cloudfoundry/uaa/security/code-scanning/127

[Copilot]

🔵 Needs a closer look

Human validation is warranted because the change alters CSRF bypass and bearer-authentication filter ordering for client-administration mutations, requiring integration checks across deployed proxies, servlet containers, and legacy clients beyond MockMvc coverage.

No open issues 🎉

What changed in this PR

This pull request mitigates CSRF exposure on client administration endpoints by requiring CSRF validation for state-changing requests authenticated with the legacy access_token parameter, while allowing authenticated bearer-token requests to bypass CSRF protection.

Changes:

• Enables cookie-based CSRF protection for client administration mutations unless a non-empty bearer token is supplied.
• Adds MockMvc coverage for bearer, legacy parameter, session, invalid-token, and CSRF scenarios.
• Documents the updated authentication and CSRF requirements in generated API and client-authentication documentation.

File	Description
uaa/​src/​test/​java/​org/​cloudfoundry/​identity/​uaa/​mock/​clients/​ClientAdminEndpointDocs.java	Adds generated API documentation coverage for client-admin mutations requiring CSRF protection.
uaa/​src/​test/​java/​org/​cloudfoundry/​identity/​uaa/​mock/​clients/​ClientAdminCsrfMockMvcTests.java	Adds comprehensive tests for client-admin CSRF enforcement and authentication behavior.
uaa/​slateCustomizations/​source/​index.html.md.erb	Updates generated client administration API documentation with CSRF requirements and forbidden-response guidance.
server/​src/​main/​java/​org/​cloudfoundry/​identity/​uaa/​client/​ClientAdminSecurityConfiguration.java	Configures CSRF protection for client administration endpoints with an exception for non-empty bearer authorization headers.
docs/​UAA-Client-Authentication.md	Documents bearer-token and legacy access_token authentication requirements for client administration, including CSRF behavior.

_{Review effort: Lite}