title: Spring Security CSRF support for manual security configuration
body: <p>I am dealing with a complex manual security configuration (Spring 3.4, Spring Security 3.2).  The filter chains have been configured manually with <code>httpSessionContextIntegrationFilter</code> and other beans configured by us.</p>
  
  <pre><code>&lt;bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy"&gt;
      &lt;security:filter-chain-map path-type="ant" request-matcher="ant"&gt;
          &lt;security:filter-chain pattern="/**" filters="httpSessionContextIntegrationFilter, ... beans ...,filterInvocationInterceptor"/&gt;
      &lt;/security:filter-chain-map&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>Now, I need to add CSRF protection.  I cannot add http and csrf tags, as http is duplicating the manual config.  Instead, I tried to configure this in Java, but the Java config does not add CSRF filter. </p>
  
  <pre><code>@EnableWebSecurity
  @Configuration
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
      ...
  }
  </code></pre>
  
  <p>I declared the bean <code>&lt;bean class="package.WebSecurityConfig"/&gt;</code> in application context, yet WebSecurityConfigurerAdapter.configure method is never called on app context creation.</p>
  
  <p>How can I add CSRF protection here?  Do I need to insert CSRFFilter manually as well?</p>