title: how spring security works
body: <p><strong>Purpose</strong> of my question is to <strong>understand</strong> and get clear picture of how Security /Session work in Spring . As i am quiet new to Spring concepts.
  i followed this tutorial to understand</p>
  
  <p><a href="https://spring.io/guides/tutorials/spring-security-and-angular-js/" rel="nofollow">https://spring.io/guides/tutorials/spring-security-and-angular-js/</a></p>
  
  <p>My aim is : when user requests for some resource (for eg. /order/details) and if that request has no token in header then it should be redirected to login page with new token .</p>
  
  <pre><code>    @EnableWebSecurity
  @Configuration
  @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
  public class Config extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http.httpBasic().and().authorizeRequests().antMatchers("/*")
                  .permitAll().anyRequest().authenticated().and().csrf()
                  .csrfTokenRepository(csrfTokenRepository()).and()
                  .addFilterAfter(csrfHeaderFilter(), CsrfFilter.class);
  
      }
  
      private Filter csrfHeaderFilter() {
          return new OncePerRequestFilter() {
              @Override
              protected void doFilterInternal(HttpServletRequest request,
                      HttpServletResponse response, FilterChain filterChain)
                      throws ServletException, IOException {
                  CsrfToken csrf = (CsrfToken) request
                          .getAttribute(CsrfToken.class.getName());
                  if (csrf != null) {
                      Cookie cookie = WebUtils.getCookie(request, "XSRF-TOKEN");
                      String token = csrf.getToken();
                      if (cookie == null || token != null
                              &amp;&amp; !token.equals(cookie.getValue())) {
                          cookie = new Cookie("XSRF-TOKEN", token);
                          cookie.setPath("/");
                          response.addCookie(cookie);
                          response.sendRedirect("/login");
                      }
                  }
                  filterChain.doFilter(request, response);
              }
          };
      }
  
      private CsrfTokenRepository csrfTokenRepository() {
          HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
          repository.setHeaderName("X-XSRF-TOKEN");
          return repository;
      }
  }
  </code></pre>
  
  <p>the above code works fine but regarding redirecting to login page,i am not able to achieve it.</p>
  
  <p>Please help me in understanding the concept here . if you need any more details please let me know.</p>
  
  <p>Thanks </p>