title: How to obtain CSRF attributes value from SpringSecurity using Javascript?
body: <p>I am trying to enable csrf protection within Spring Security and after reading <a href="https://stackoverflow.com/questions/20862299/with-spring-security-3-2-0-release-how-can-i-get-the-csrf-token-in-a-page-that">this post</a> I came up with the following config so far:</p>
  
  <pre><code>public final class CsrfTokenGeneratorFilter extends OncePerRequestFilter {
      @Override
      protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
          CsrfToken token = (CsrfToken) request.getAttribute("_csrf");
          response.setHeader("X-CSRF-HEADER", token.getHeaderName());
          response.setHeader("X-CSRF-PARAM", token.getParameterName());
          response.setHeader("X-CSRF-TOKEN", token.getToken());
          filterChain.doFilter(request, response);
      }
  }
  </code></pre>
  
  <p>I also added the following to my spring-security xml file:</p>
  
  <pre><code>&lt;custom-filter ref="csrfFilter" after="CSRF_FILTER"/&gt;
  ...
  &lt;beans:bean id="csrfFilter" class="com.foo.config.CsrfTokenGeneratorFilter"/&gt;
  </code></pre>
  
  <p>The problem I am facing right now is request.getAttribute("_csrf") always return a null value. Am I missing something? How am I supposed to add the _csrf value to the request?</p>
  
  <p>I am using pure HTML + AJAX.</p>
  
  <p>Thanks.</p>