False positive Java. SpringBoot CSRF

Start by locating the CodeQL query named "Disabled Spring CSRF protection" and review how it identifies Spring Security configurations. Reproduce the provided stateless JWT/OIDC resource-server example, then verify that disabling CSRF no longer triggers the query for this configuration while the reported case remains covered.

Description of the false positive

Given a SpringBoot application that acts solely as an API/OIDC Resource Server and does not utilize cookies or state, where CSRF is disabled, the CodeQL / Disabled Spring CSRF protection should not be triggered.

Code samples or links to source code

  @Bean
  SecurityFilterChain securityFilterChain(
      final HttpSecurity http,
      final String privateScope,
      final AppUserPrincipalJwtAuthenticationConverter appUserPrincipalJwtAuthenticationConverter) {
    http.formLogin(AbstractHttpConfigurer::disable)
        .httpBasic(AbstractHttpConfigurer::disable)
        .csrf(AbstractHttpConfigurer::disable) // NOSONAR stateless JWT, no CSRF cookies
        .logout(AbstractHttpConfigurer::disable)
        .sessionManagement(
            session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
        .authorizeHttpRequests(
            authorize ->
                authorize
                    .dispatcherTypeMatchers(DispatcherType.ERROR, DispatcherType.FORWARD)
                    .permitAll()
                    .requestMatchers(RuntimeEndpointPaths.unauthenticatedPaths())
                    .permitAll()
                    .requestMatchers(
                        new RegexRequestMatcher(
                            RuntimeEndpointPaths.versionedInternalRouteRegex(), null))
                    .access(interactiveUserAuthorizationManager())
                    .requestMatchers(
                        new RegexRequestMatcher(
                            RuntimeEndpointPaths.versionedPrivateRouteRegex(), null))
                    .access(
                        callerTypeAuthorizationManager(
                            OidcCallerType.CLIENT_CREDENTIALS, privateScope))
                    .anyRequest()
                    .authenticated())
        .oauth2ResourceServer(
            oauth2 ->
                oauth2.jwt(
                    jwt ->
                        jwt.jwtAuthenticationConverter(
                            appUserPrincipalJwtAuthenticationConverter)));
    return http.build();
  }