title: Spring security: activating csrf disables /logout
body: <p>I'm trying to enable csrf protection, but for the login page only.
  I added the following spring security configuration (the <code>&lt;http&gt;</code> tag already existed)</p>
  
  <pre><code>&lt;http ... &gt;
    &lt;sec:csrf request-matcher-ref="myBean" /&gt;
    ...
  &lt;/http&gt;
  
  &lt;bean id="myBean" class="org.springframework.security.web.util.matcher.AntPathRequestMatcher"&gt;
    &lt;constructor-arg name="pattern" value="/login"/&gt;
    &lt;constructor-arg name="httpMethod" value="POST"/&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>The login page now indeed has csrf protection. However for a strange reason, <code>/logout</code> now gives a 404 error. In fact, if I replace <code>/login</code> with <code>/foobar</code>, I still have a 404 error on /logout. But if I add <code>disabled="true"</code> in the  <code>&lt;sec:csrf/&gt;</code> tag, it works again. </p>
  
  <p>Any idea why ?</p>
  
  <p>Thanks</p>