Spring csrf security is null

Question

I have a login form and want to protect it from csrf attacks.

My spring -security.xml

<sec:http auto-config="true" use-expressions="true"> ... <sec:csrf /> </sec:http> 

My jsp file (use tiles):

 <form class="navbar-form navbar-right form-inline" method="POST" role="form" action="j_spring_security_check"> <div class="form-group"> <input class="form-control" type="email" name="j_username"> </div> <div class="form-group"> <input class="form-control" type="password" name="j_password"> </div> <button class="btn btn-default" type="submit">Login</button> <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"> </form> 

I can resolve, but csrf is empty:

 <input type="hidden" value="" name=""> 

Can anybody help me?

Answer 1

if you apply security = "none", then the csrf token will not be created. page will not go through the security filter. Use the ANONYMOUS role.

I did not tell in detail, but it works for me.

 <http auto-config="true" use-expressions="true"> <intercept-url pattern="/login.jsp" access="hasRole('ANONYMOUS')" /> <!-- you configuration --> </http> 

Answer 2

Are you sure you configured JSTL correctly? Have you tried using the tag instead? If the following is true, then the JSTL is probably not configured correctly:

 <c:out value="${_csrf.parameterName}"/> 

To be sure, do you have any blocks? If so, make sure that you have not disabled protection in the login form.

Answer 3

I cleaned the .m2 directory and re-imported all the dependecies. It helps me.