title: how Play sends CSRF token?
body: <p>When my application retrieves <code>index.html</code> and other <code>js</code> and <code>css</code> files from the server, I do not see an <code>csrf</code> token in headers or cookies. How does <code>play</code> sends csrf token?</p>
  
  <p>My UI is an <code>Angular</code> application being served from <code>play</code>. From the documents, I read about <code>csrf</code> token that </p>
  
  <p><code>This token gets placed either in the query string or body of every form submitted, and also gets placed in the user’s session</code></p>
  
  <p>The documentation also says that </p>
  
  <p><code>To ensure that a CSRF token is available to be rendered in forms, and sent back to the client, the global filter will generate a new token for all</code>GET<code>requests that accept HTML, if a token isn’t already available in the incoming request.</code> - But I don't see this token in response to my initial <code>GET</code> request.</p>
  
  <p>As my UI (and thus form) is not a play UI, I cannot use <code>play</code>'s annotation to put <code>csrf</code> token in the form. I would like that when the homepage is delivered, play sends the <code>csrf</code> token which <code>Angular</code> application can store and use later.</p>
  
  <p>Following are the headers I see on browser's developer console.</p>
  
  <p>Response headers</p>
  
  <pre><code>Content-Length      1421
  Content-Type        text/html; charset=UTF-8
  Date        Sun, 11 Mar 2018 21:23:52 GMT
  Referrer-Policy     origin-when-cross-origin, strict-origin-when-cross-origin
  X-Content-Type-Options      nosniff
  X-Frame-Options     DENY
  X-Permitted-Cross-Domain-Policies       master-only
  X-XSS-Protection        1; mode=block
  </code></pre>
  
  <p>Request headers (600 B)     </p>
  
  <pre><code>Accept      text/html,application/xhtml+xm…plication/xml;q=0.9,*/*;q=0.8
      Accept-Encoding     gzip, deflate
      Accept-Language     en-US,en;q=0.5
      Connection      keep-alive
      Cookie      PLAY_SESSION=eyJhbGciOiJIUzI1N…AR2uh5KwKBhqKxQQT1wWPWC2yPyCM
      Host        localhost:9000
      Upgrade-Insecure-Requests       1
      User-Agent      Mozilla/5.0 (Windows NT 10.0; …) Gecko/20100101 Firefox/58.0
  </code></pre>
  
  <p>The <code>Action</code> in play which servers the homepage is</p>
  
  <pre><code>def index =
      Action { implicit request =&gt;
        val Token(name, value) = CSRF.getToken.get
        println(s"Token name ${name}, value ${value}")
        Ok(views.html.index("Your new application is ready."))
      }
  </code></pre>
  
  <p>I can see (print) the token name and value but I am not sure if it is being sent in the <code>Ok</code> response.</p>