title: Principal is null in controller when using http.csrf().disable()
body: <p>I have a controller and POJO that I want to test. The <code>GET</code> to the REST interface forces a login and returns a principal object and so all is good. I was able to extend <code>WebSecurityConfigurerAdapter</code> to enable and username and password for testing. </p>
  
  <p>However, during testing, the Spring framework requires a CSRF token for a <code>POST</code> request. Since I have no UI and I am only testing the REST interface I want to disable it temporarily.</p>
  
  <p>So I extended <code>WebSecurityConfigurerAdapter</code> as per the documentation:</p>
  
  <pre class="lang-java prettyprint-override"><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      public void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth
              .inMemoryAuthentication()
                  .withUser("user").password("{noop}password").roles("USER");
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.csrf().disable();    
      }
  }
  </code></pre>
  
  <p>However this disabled the authentication. My controller receives a <code>Principal</code> object that is <code>null</code>. Here is my controller:</p>
  
  <pre class="lang-java prettyprint-override"><code>import java.security.Principal;
  
  import org.springframework.context.annotation.Scope;
  import org.springframework.security.core.annotation.AuthenticationPrincipal;
  import org.springframework.web.bind.annotation.RequestBody;
  import org.springframework.web.bind.annotation.RequestMapping;
  import org.springframework.web.bind.annotation.RequestMethod;
  import org.springframework.web.bind.annotation.RestController;
  
  import com.neutech.model.ShoppingCart;
  
  @Scope("session")
  @RestController
  @RequestMapping("/cart/api/v1")
  public class SomeController {
  
      @RequestMapping(value = "/thing", method = RequestMethod.POST)
      public void create(@RequestBody String stuff,@AuthenticationPrincipal Principal user) {
  
           // do stuff
  }
  </code></pre>
  
  <p>I have tried various flavours of setting CSRF for specific URLs or HTTP verbs. All with the same result. The principal delivered to the controller is <code>null</code>.</p>
  
  <p>After scouring the net for some kind of resolution to this I can come up with nothing. There are lots of examples tell me to do exactly what I am doing. However I only find only other similar type questions.</p>
  
  <p>Can someone explain to me what I am doing wrong?</p>