title: Spring Boot with Application authentication (403 Fobidden) CSRF token was null. Has your session expired?
body: <p>I have a Spring Boot application with thymeleaf template and using HTML with AngularJS as my frontend with mysql as DATABASE and data is passed in JSON </p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;html xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4"&gt;
  &lt;head&gt;
      &lt;meta name="_csrf" content="${_csrf.token}"/&gt;   
      &lt;meta name="_csrf_header" content="${_csrf.headerName}"/&gt;
  &lt;/head&gt;
  </code></pre>
  
  <p>My JS file which value gets posted to :</p>
  
  <pre><code>$scope.logincheck = function() {
  
  var dataObj = {
          userId : $scope.userId,
          password : $scope.password
  };
  
  var res = $http.post('http://localhost:9393/company/login', dataObj);
  </code></pre>
  
  <p>and the corresponding controller which handles mysql authentication :</p>
  
  <pre><code>@RequestMapping(value = "/company/login", method = RequestMethod.POST)
  </code></pre>
  
  <p>not getting called if CSRF is enabled. Upon CSRF enabling, i got 403 error saying CSRF token null was found. </p>
  
  <p>My webconfig.java :</p>
  
  <pre><code>@Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http 
              .addFilterAfter(new CsrfHeaderFilter(), CsrfFilter.class)
              .authorizeRequests()
              .antMatchers("/resources/**").permitAll()
              .antMatchers("/", "/login").permitAll()
                  .antMatchers("/hello").access("hasRole('ADMIN')")
                  .anyRequest().authenticated()
                  .and()
              .formLogin()
                  .loginPage("/login")
                  .permitAll()
                  .and()
              .logout()
              .logoutUrl("/logout")
              .logoutSuccessUrl("/login")
              .permitAll()
              .and()
              .exceptionHandling().accessDeniedPage("/accessdenied")
              .and()
              .csrf()
              .csrfTokenRepository(csrfTokenRepository());
      }
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          auth
              .inMemoryAuthentication()
                  .withUser("user").password("password").roles("ADMIN")
      }
  
      private CsrfTokenRepository csrfTokenRepository() 
      { 
          HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository(); 
          repository.setHeaderName("X-XSRF-TOKEN");
          return repository; 
      }
  
      public class CsrfHeaderFilter extends OncePerRequestFilter {
            @Override
            protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
                throws ServletException, IOException {
                System.out.println("Inside Webappconfig.java");
              CsrfToken csrf = (CsrfToken) request.getAttribute(CsrfToken.class.getName());
              if (csrf != null) {
                Cookie cookie = WebUtils.getCookie(request, "XSRF-TOKEN");
                String token = csrf.getToken();
                if (cookie==null || token!=null &amp;&amp; !token.equals(cookie.getValue())) {
                  cookie = new Cookie("XSRF-TOKEN", token);
                  cookie.setPath("/");
                  response.addCookie(cookie);
                }
              }
              filterChain.doFilter(request, response);
            }
          }
  </code></pre>