title: spring boot csrf and jade
body: <p>I’ve got a Spring Boot application with java configuration. I’m only referencing spring-boot-starter-jade4j and spring-boot-starter-security in my build.gradle file. I’m trying to figure out why I can’t get a csrf token to appear.
  Here’s my SecurityConfig</p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    DataSource ds;
  
    @Override
    protected void configure(HttpSecurity http) throws Exception {
      http
          .authorizeRequests()
              .antMatchers("/", "/signup", "/js/**", "/css/**", "/terms", "/privacy", "/favicon.ico").permitAll()
              .anyRequest().authenticated()
              .and()
          .formLogin()
              .loginPage("/login")
              .permitAll()
              .and()
          .logout()
              .logoutUrl("/logout")
              .permitAll()
              .and()
          .csrf();
    }
  …
  }
  </code></pre>
  
  <p>Here’s my login form. The CSRF hidden field shows in the source code, but the csrf token doesn’t seem to evaluate and the value is empty.</p>
  
  <pre><code>extends _base
  block head
  
  block body
    #bodContent.container-fluid
    .row
      .col-md-4
      .col-md-4
        br
        .panel.panel-default
          .panel-body
            h1 Please log in
            form(method="POST", action="/login")
              input(type="hidden", name='_csrf', value='#{_csrf}')
              .form-group
                label(for="email")
                  | Email address
                input#username.form-control(name="username", type="email", value="")
              .form-group
                label(for="password")
                  | Password
                input#password.form-control(name="password", type="password", value="")
              .checkbox
                label
                  input(type="checkbox")
                  | Remember me
              input.btn.btn-default(type="submit")
                | Submit
      .col-md-4
  </code></pre>