title: Why no CSRF cookie is generated for my request?
body: <p>I'm trying to activate the CSRF cookies in Spring. So I have the following class:</p>
  
  <p><strong>SecurityAdapter.java</strong></p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityAdapter extends WebSecurityConfigurerAdapter
  {
      @Override
      protected void configure(HttpSecurity http)
              throws Exception
      {
          http
              .csrf()
                  .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
      }
  }
  </code></pre>
  
  <p>Since I'm trying to implement a REST web service (no HTML or anything), I believe the first request to the server should be a GET one because other request types will require <code>XSRF-TOKEN</code> and we don't have that yet.</p>
  
  <p>So when I send a GET request, I expect to receive some cookies in response (I've been a good boy after all!). But I don't get any.</p>
  
  <p>Here's the rest of the project files:</p>
  
  <p><strong>pom.xml</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"&gt;
      &lt;modelVersion&gt;4.0.0&lt;/modelVersion&gt;
  
      &lt;groupId&gt;com.example&lt;/groupId&gt;
      &lt;artifactId&gt;demo&lt;/artifactId&gt;
      &lt;version&gt;0.0.1-SNAPSHOT&lt;/version&gt;
      &lt;packaging&gt;jar&lt;/packaging&gt;
  
      &lt;name&gt;demo&lt;/name&gt;
      &lt;description&gt;Demo project for Spring Boot&lt;/description&gt;
  
      &lt;parent&gt;
          &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-parent&lt;/artifactId&gt;
          &lt;version&gt;1.4.2.RELEASE&lt;/version&gt;
          &lt;relativePath/&gt; &lt;!-- lookup parent from repository --&gt;
      &lt;/parent&gt;
  
      &lt;properties&gt;
          &lt;project.build.sourceEncoding&gt;UTF-8&lt;/project.build.sourceEncoding&gt;
          &lt;project.reporting.outputEncoding&gt;UTF-8&lt;/project.reporting.outputEncoding&gt;
          &lt;java.version&gt;1.8&lt;/java.version&gt;
      &lt;/properties&gt;
  
      &lt;dependencies&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-web&lt;/artifactId&gt;
          &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-test&lt;/artifactId&gt;
              &lt;scope&gt;test&lt;/scope&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
              &lt;artifactId&gt;spring-security-core&lt;/artifactId&gt;
              &lt;version&gt;4.1.1.RELEASE&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
              &lt;artifactId&gt;spring-security-config&lt;/artifactId&gt;
              &lt;version&gt;4.1.1.RELEASE&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
              &lt;artifactId&gt;spring-security-web&lt;/artifactId&gt;
              &lt;version&gt;4.1.1.RELEASE&lt;/version&gt;
          &lt;/dependency&gt;
      &lt;/dependencies&gt;
      &lt;build&gt;
          &lt;plugins&gt;
              &lt;plugin&gt;
                  &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
                  &lt;artifactId&gt;spring-boot-maven-plugin&lt;/artifactId&gt;
              &lt;/plugin&gt;
          &lt;/plugins&gt;
      &lt;/build&gt;
  &lt;/project&gt;
  </code></pre>
  
  <p><strong>DemoApplication.java</strong></p>
  
  <pre><code>package com.example;
  
  import org.springframework.boot.SpringApplication;
  import org.springframework.boot.autoconfigure.SpringBootApplication;
  
  @SpringBootApplication
  public class DemoApplication
  {
      public static void main(String[] args) {
          SpringApplication.run(DemoApplication.class, args);
      }
  }
  </code></pre>
  
  <p><strong>Controller.Java</strong></p>
  
  <pre><code>package com.example;
  
  import org.springframework.http.ResponseEntity;
  import org.springframework.web.bind.annotation.RequestMapping;
  import org.springframework.web.bind.annotation.RequestMethod;
  import org.springframework.web.bind.annotation.RestController;
  
  @RestController
  public class Controller
  {
      @RequestMapping(value = "/first", method = RequestMethod.GET)
      public ResponseEntity get()
      {
          return ResponseEntity.ok("first");
      }
  
      @RequestMapping(value = "/second", method = RequestMethod.POST)
      public ResponseEntity post()
      {
          return ResponseEntity.ok("second");
      }
  }
  </code></pre>
  
  <p>When I call the <code>second</code> method (of course in POST method), I get:</p>
  
  <pre><code>{
    "timestamp": 1481500256460,
    "status": 403,
    "error": "Forbidden",
    "message": "Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-XSRF-TOKEN'.",
    "path": "/second"
  }
  </code></pre>
  
  <p>But when I get the <code>first</code> method in GET while it is called, I don't get any cookies to use and call the <code>second</code> method!</p>
  
  <p>What am I missing something here?</p>