anchor.diff:      }
   }
   ----
  -
   <1> Inject the `csrfToken.html` as a `Template`.
  -<2> Return HTML form with a hidden form field containing a CSRF token created by the CSRF filter.
  -<3> Handle the form POST request, this method can only be invoked only if the CSRF filter has successfully verified the token.
  +<2> Return the HTML form with a hidden form field containing a CSRF token created by the CSRF filter.
  +<3> Handle the form POST request, this method can only be invoked if the CSRF filter has successfully verified the token.
   
   The form POST request will fail with HTTP status `400` if the filter finds the hidden CSRF form field is missing, the CSRF cookie is missing, or if the CSRF form field and CSRF cookie values do not match.
   
  -At this stage no additional configuration is needed - by default the CSRF form field and cookie name will be set to `csrf_token`, and the filter will verify the token. But lets change these names:
  +At this stage no additional configuration is needed - by default the CSRF form field and cookie name will be set to `csrf_token`, and the filter will verify the token. But let's change these names:
   
   [source,properties]
   ----
  
positive.code: 
  include::./attributes.adoc[]
  
  https://owasp.org/www-community/attacks/csrf[Cross-Site Request Forgery(CSRF)] is an attack that forces an end user to execute unwanted actions on a web application in which they are currently authenticated.
  
  Quarkus Security provides a CSRF prevention feature which consists of a xref:resteasy-reactive.adoc[Resteasy Reactive] server filter which creates and verifies CSRF tokens and an HTML form parameter provider which supports the xref:qute-reference.adoc#injecting-beans-directly-in-templates[injection of CSRF tokens in Qute templates].
  
  == Creating the Project
  
  
negative.code: </body>
  </html>
  ----
  <1> This expression is used to inject a CSRF token into a hidden form field. This token will be verified by the CSRF filter against a CSRF cookie.
  
  Now let's create a resource class which returns an HTML form and handles form POST requests:
  
  