GraphiQL starter is not compatible with Spring security

[jonrimmer]

Spring Security enables CSRF protection by default and thus requires the CSRF token header on POST requests to the /graphql endpoint. If Spring Security is loaded and CSRF protection is not disabled, the /graphiql endpoint will get a 403 error when it tries to access the /graphql endpoint.

GraphiQLController should check the _csrf attribute in the request and, if it exists, use the header name and the token it contains to add a header to the headers collection used by the fetcher function supplied to GraphiQL.

[oliemansm]

Thanks for reporting it, fixed this in 5.9.1