title: Spring boot with thymeleaf _csrf failing to initialize
body: <p>I am trying to setup a basic auth page with Spring (spring-boot).
  When I disable CSRF protection the login works fine, but I get HTTP 405 for POST /login after authentication has complete. From my research it looks like that was because of CSRF was not enabled. I removed from my config <code>htto.csrf().disable()</code>, according to all docs and comments I've read I was expecting to see extra hidden field.</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code> &lt;input
                          type="hidden"
                          th:name="${_csrf.parameterName}"
                          th:value="${_csrf.token}" /&gt;</code></pre>
  </div>
  </div>
  </p>
  
  <p>That didn't happen. Then I added that manually, but I am getting an exception when Thymeleaf is parsing the template.</p>
  
  <blockquote>
    <p>org.springframework.expression.spel.SpelEvaluationException: EL1007E: Property or field 'parameterName' cannot be found on null</p>
  </blockquote>
  
  <p>Looks like _csrf is empty. </p>
  
  <p>Here is what I have in gradle build.gradle:</p>
  
  <blockquote>
    <p>compile(group: 'org.springframework.boot', name:
    'spring-boot-starter-thymeleaf')
        compile(group: 'org.springframework.boot', name: 'spring-boot-starter-security')
    compile("org.springframework.boot:spring-boot-starter-web")</p>
  </blockquote>
  
  <p>This is my config:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
  @Autowired
  UserRoleDetailService userDetailService;
  
  @Override
  @Bean
  public AuthenticationManager authenticationManagerBean() throws Exception {
      return super.authenticationManagerBean();
  }
  
  @Bean
  public TokenStore tokenStore() {
      return new InMemoryTokenStore();
  }
  
  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
      auth.userDetailsService(userDetailService).passwordEncoder(passwordEncoder());
  }
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http
              .authorizeRequests()
              .antMatchers("/registration", "/error/access-denied", "/login**", "/logout").permitAll()
              .antMatchers("/admin/**").hasRole("ADMIN")
              .anyRequest().authenticated()
              .and()
              .formLogin().loginPage("/login").successForwardUrl("/admin/home").permitAll()
              .and()
              .httpBasic()
              .and()
              .logout().logoutSuccessUrl("/");
      http.userDetailsService(userDetailService);
  
  }
  
  
  @SuppressWarnings("deprecation")
  @Bean
  public static PasswordEncoder passwordEncoder() {
      return NoOpPasswordEncoder.getInstance();
  }
  }
  </code></pre>
  
  <p>Thymeleaf 3.0.9
  Spring 5.0.4</p>
  
  <p>What am I doing wrong here?
  Any input appreciated! Thank you!</p>
  
  <p>Update with HTML form</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>            &lt;form th:action="@{/login}" method="post" class="form-signin"&gt;
                  &lt;h3 class="form-signin-heading" th:text="Welcome"&gt;&lt;/h3&gt;
                  &lt;br/&gt;
  
                  &lt;input type="text" id="username" name="username" th:placeholder="Email"
                         class="form-control"/&gt; &lt;br/&gt;
                  &lt;input type="password" th:placeholder="Password"
                         id="password" name="password" class="form-control"/&gt; &lt;br/&gt;
                  &lt;input
                          type="hidden"
                          th:name="${_csrf.parameterName}"
                          th:value="${_csrf.token}" /&gt;
                  &lt;div align="center" th:if="${param.error}"&gt;
                      &lt;p style="font-size: 20; color: #FF1C19;"&gt;Email or Password invalid, please verify&lt;/p&gt;
                  &lt;/div&gt;
                  &lt;button class="btn btn-lg btn-primary btn-block" name="Submit" value="Login" type="Submit"
                          th:text="Login"&gt;&lt;/button&gt;
              &lt;/form&gt;</code></pre>
  </div>
  </div>
  </p>
  
  <p>Update #2</p>
  
  <p>After tinkering with my code I figured that when I disabled the Resource server config the CSRF token started showing up as per documentation. Now the mystery is why having an OAuth2 resource server messes up with csrf being properly inserted?</p>
  
  <p>Here is my Resource server config</p>
  
  <pre><code>@Configuration
  @EnableResourceServer
  public class ResourceServerConfig extends 
  ResourceServerConfigurerAdapter {
  
  @Autowired
  private TokenStore tokenStore;
  
  @Override
  public void configure(ResourceServerSecurityConfigurer resources) {
      resources.tokenStore(tokenStore);
      resources.resourceId(AuthorizationServerConfig.API_RESOURCE_ID).stateless(false);
  }
  
  @Override
  public void configure(HttpSecurity http) throws Exception {
      http.requestMatchers()
              .and().authorizeRequests()
              .antMatchers("/users/**")
              .access("#oauth2.hasScope('read')")
              .and().exceptionHandling().
              accessDeniedHandler(new OAuth2AccessDeniedHandler());
  }
  
  }
  </code></pre>