Issues with first time checkout as unauthenticated/anonymous user

[ThomBreugelmans]

Issues with first time checkout as unauthenticated/anonymous user

[ThomBreugelmans]

Spring boot apparently only sets the XSRF-TOKEN on requests that modify the state of the server (e.g. no GET), see section 3 in https://www.baeldung.com/spring-security-csrf
This means that an unauthenticated user who has not yet visited the site or ordered something, will not have an XSRF-TOKEN yet. And when they go to checkout they will make their first POST request, which will set their XSRF-TOKEN. However this request will also be rejected with a 403 because they do not have a valid token yet and the endpoint is protected. Though, if they try this again it will succeed as they now have a valid token.

I think the /checkout POST endpoint should not be protected with CSRF as it leads to these current issues, additionally there is no harm done by creating a checkout as it does not harm users (no money gets stolen, nor (personal) details).