title: Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-CSRF-TOKEN'
body: <p>After configuring Spring Security 3.2, <code>_csrf.token</code> is not bound to a request or a session object.</p>
  
  <p>This is the spring security config:</p>
  
  <pre><code>&lt;http pattern="/login.jsp" security="none"/&gt;
  
  &lt;http&gt;
      &lt;intercept-url pattern="/**" access="ROLE_USER"/&gt;
      &lt;form-login login-page="/login.jsp"
                  authentication-failure-url="/login.jsp?error=1"
                  default-target-url="/index.jsp"/&gt;
      &lt;logout/&gt;
      &lt;csrf /&gt;
  &lt;/http&gt;
  
  &lt;authentication-manager&gt;
      &lt;authentication-provider&gt;
          &lt;user-service&gt;
              &lt;user name="test" password="test" authorities="ROLE_USER/&gt;
          &lt;/user-service&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  </code></pre>
  
  <p>The login.jsp file</p>
  
  <pre><code>&lt;form name="f" action="${contextPath}/j_spring_security_check" method="post" &gt;
      &lt;input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" /&gt;
      &lt;button id="ingresarButton"
              name="submit"
              type="submit"
              class="right"
              style="margin-right: 10px;"&gt;Ingresar&lt;/button&gt;
      &lt;span&gt;
          &lt;label for="usuario"&gt;Usuario :&lt;/label&gt;
          &lt;input type="text" name="j_username" id="u" class="" value=''/&gt;
      &lt;/span&gt;
      &lt;span&gt;
          &lt;label for="clave"&gt;Contrase&amp;ntilde;a :&lt;/label&gt;
  
          &lt;input type="password"
                 name="j_password"
                 id="p"
                 class=""
                 onfocus="vc_psfocus = 1;"
                 value=""&gt;
      &lt;/span&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>And it renders the next html:</p>
  
  <pre><code>&lt;input type="hidden" name="" value="" /&gt;
  </code></pre>
  
  <p>The result is 403 HTTP status:</p>
  
  <pre><code>Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-CSRF-TOKEN'.
  </code></pre>
  
  <p><strong>UPDATE</strong>
  After some debug, the request object gets out fine form DelegatingFilterProxy, but in the line 469 of CoyoteAdapter it executes request.recycle(); that erases all the attributes...</p>
  
  <p>I test in Tomcat 6.0.36, 7.0.50 with JDK 1.7.</p>
  
  <p>I have not understood this behavior, rather than, it would be possible if someone point me in the direction of some application sample war with Spring Security 3.2 that works with CSRF.</p>