title: Setting up CsrfPreventionFilter in Tomcat
body: <p>I am attempting to set up the inbuilt CsrfPreventionFilter in Tomcat 8.</p>
  
  <p>I think I have read all the questions and answers in StackOverflow on this subject, but I can still not solve my problem. </p>
  
  <p>I have <code>home.jsp</code> and <code>reports.jsp</code></p>
  
  <p>The URL of <code>home.jsp</code> (once it has been subjected to <code>response.encodeUrl()</code>) is
  <code>www.example.com/home.jsp?org.apache.catalina.filters.CSRF_NONCE=5E4BD8FEE1B4CC1DA79D874905015911</code></p>
  
  <p>This is rendered correctly, not because the nonce is working, but because I set <code>home.jsp</code> to be an EntryPoint. However it does seem to prove that the CSRFPreventionFilter is up and running and generating nonces successfully.</p>
  
  <p>If I press CTRL+N and then type in <code>www.example.com/reports.jsp</code> and then I add the same nonce, i.e. <code>www.example.com/reports.jsp?org.apache.catalina.filters.CSRF_NONCE=5E4BD8FEE1B4CC1DA79D874905015911</code> then I get page 403. <code>reports.jsp</code> is not set up as an EntryPoint, but I would expect it to render successfully, as it has been supplied with a nonce.</p>
  
  <p>What am I doing wrong?</p>
  
  <p>(My question is somewhat similar to <a href="https://stackoverflow.com/questions/13151768/getting-403-error-when-using-csrf-filter-with-tomcat-6-0-32">Getting 403 error when using CSRF filter with tomcat 6.0.32</a>; but I feel that the answer is probably not in the way the CSRFPrevention Filter is set up, but perhaps some issue in the way I am dealing with the response/request internally, akin to @Pankaj Kumar's answer in  <a href="https://stackoverflow.com/questions/36530341/not-able-to-authenticate-post-request-for-csrf-token-with-tomcat">Not able to authenticate post request for CSRF token with tomcat</a>)</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>Here is the web.xml configuration</p>
  
  <pre><code>&lt;filter&gt;
      &lt;filter-name&gt;CSRFPreventionFilter&lt;/filter-name&gt;
      &lt;filter-class&gt;org.apache.catalina.filters.CsrfPreventionFilter&lt;/filter-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;entryPoints&lt;/param-name&gt;
              &lt;param-value&gt;/images/404.JPG,/login.jsp,/home.jsp,/images/im_login.gif,/js/events.js,/js/menu.js,/js/amount_validation.js,/js/calendar.js,/js/toolbar.js,/js/tablesort.js,/js/scripts.js,/css/style.css&lt;/param-value&gt;
          &lt;/init-param&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;CSRFPreventionFilter&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;  
  </code></pre>