Spring:如何保护登录页面免受csrf攻击(不破坏更改)？

http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());

<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />

http.csrf().requireCsrfProtectionMatcher(new RequestMatcher() {
    private Pattern allowedMethods = Pattern.compile("^(GET|HEAD|TRACE|OPTIONS)$");
    private RegexRequestMatcher apiMatcher = new RegexRequestMatcher("/api/.*", null);

    @Override
    public boolean matches(HttpServletRequest request) {
        // 允许GET、HEAD、TRACE和OPTIONS请求
        if (allowedMethods.matcher(request.getMethod()).matches())
            return false;

        // 允许特定的API请求
        if (apiMatcher.matches(request))
            return false;

        // 其他请求需要进行CSRF保护
        return true;
    }
});