title: HTTP Status 403 - Invalid CSRF Token '9ee6949c-c5dc-4d4b-9d55-46b75abc2994' was found on the request parameter '_csrf' or header 'X-CSRF-TOKEN'
body: <p>I am developing a web application which has a front-end with angularjs and a back-end with spring-security and jersey.</p>
  
  <p>I am trying to implement spring-security. I can authenticate the user. But I stucked at the logout point. I am sending the X-CSRF-TOKEN within a value, but it seems that spring-security is refusing it.</p>
  
  <p>web.xml</p>
  
  <pre><code>&lt;!DOCTYPE web-app PUBLIC
   "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
   "http://java.sun.com/dtd/web-app_2_3.dtd" &gt;
  
  &lt;web-app&gt;
  
  
      &lt;display-name&gt;M2Carros&lt;/display-name&gt;
  
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;
              classpath:applicationContext.xml
              classpath:spring-security.xml
          &lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;listener&gt;
          &lt;listener-class&gt;
              org.springframework.web.context.ContextLoaderListener
          &lt;/listener-class&gt;
      &lt;/listener&gt;
  
      &lt;servlet&gt;
          &lt;servlet-name&gt;jersey-serlvet&lt;/servlet-name&gt;
          &lt;servlet-class&gt;
              com.sun.jersey.spi.spring.container.servlet.SpringServlet
          &lt;/servlet-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;com.sun.jersey.config.property.packages&lt;/param-name&gt;
              &lt;param-value&gt;br.com.m2carros&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;com.sun.jersey.api.json.POJOMappingFeature&lt;/param-name&gt;
              &lt;param-value&gt;true&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;com.sun.jersey.spi.container.ContainerRequestFilters&lt;/param-name&gt;
              &lt;param-value&gt;com.sun.jersey.api.container.filter.LoggingFilter&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;com.sun.jersey.spi.container.ContainerResponseFilters&lt;/param-name&gt;
              &lt;param-value&gt;com.sun.jersey.api.container.filter.LoggingFilter&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
  
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;jersey-serlvet&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/api/*&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
  &lt;!--    Spring Security --&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;
  
      springSecurityFilterChain&lt;/filter-name&gt;
              &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy
  
  &lt;/filter-class&gt;
      &lt;/filter&gt;
  
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
      &lt;filter&gt;
      &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
      &lt;filter-class&gt;org.apache.catalina.filters.CorsFilter&lt;/filter-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;cors.allowed.headers&lt;/param-name&gt;
              &lt;param-value&gt;Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization&lt;/param-value&gt;
          &lt;/init-param&gt; 
          &lt;init-param&gt;
              &lt;param-name&gt;cors.exposed.headers&lt;/param-name&gt;
              &lt;param-value&gt;Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,X-CSRF-TOKEN&lt;/param-value&gt;
          &lt;/init-param&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>spring-security.xml</p>
  
  <pre><code>&lt;beans:beans xmlns="http://www.springframework.org/schema/security"
      xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans
      http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
      http://www.springframework.org/schema/security
      http://www.springframework.org/schema/security/spring-security-3.2.xsd"&gt;
  
      &lt;!-- enable use-expressions --&gt;
      &lt;http auto-config="true" use-expressions="true"&gt;
          &lt;intercept-url pattern="/" access="permitAll" /&gt;
          &lt;intercept-url pattern="/index.html" access="permitAll" /&gt;
          &lt;intercept-url pattern="/api/user" access="isAuthenticated()" /&gt;
          &lt;!-- enable csrf protection --&gt;
          &lt;csrf/&gt;
      &lt;/http&gt;
  
      &lt;!-- Select users and user_roles from database --&gt;
      &lt;authentication-manager&gt;
          &lt;authentication-provider&gt;
  &lt;!--            &lt;password-encoder hash="md5" /&gt;  --&gt;
              &lt;jdbc-user-service data-source-ref="dataSource"
                  users-by-username-query=
                      "select username,password, enabled from usuario where username=?"
                  authorities-by-username-query=
                      "select username, role from user_roles where username =?  " /&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p>app.js (ommited routes)</p>
  
  <pre><code>$httpProvider.defaults.headers.common["X-Requested-With"] = 'XMLHttpRequest';
      var csrfHeaderName = 'X-CSRF-TOKEN';
  
      $httpProvider.interceptors.push(function() {
          return {
              response: function(response) {
                  console.log(response.headers());
                  console.log(response.headers(csrfHeaderName));
                  if(response.headers(csrfHeaderName) != null){
                      $httpProvider.defaults.headers.common[csrfHeaderName] = response.headers(csrfHeaderName);
                  }
                  return response;
              }
          }    
      });
  </code></pre>
  
  <p>appCtrl.js</p>
  
  <pre><code>angular.module('m2App').controller('appCtrl', function($rootScope, $scope, $http, $location){
  
      var serverUrl = 'http://localhost:8080/m2carros/api';
  
      var authenticate = function(credentials, callback) {
  
          var headers = credentials ? {authorization : "Basic "
              + btoa(credentials.username + ":" + credentials.password)
          } : {};
  
          $http.get(serverUrl+'/user', {headers : headers}).then(function(response) {
            if (response.data.principal != undefined &amp;&amp; response.data.principal.username) {
              $rootScope.authenticated = true;
              console.log("is authenticated ? "+$rootScope.authenticated);
            } else {
              $rootScope.authenticated = false;
              console.log("is authenticated ? "+$rootScope.authenticated);
            }
            callback &amp;&amp; callback();
          }, function() {
            $rootScope.authenticated = false;
            console.log("is authenticated ? "+$rootScope.authenticated);
            callback &amp;&amp; callback();
          });
  
        }
  
  
        authenticate();
        $scope.credentials = {};
        $scope.login = function() {
            authenticate($scope.credentials, function() {
              if ($rootScope.authenticated) {
                $location.path("/");
                console.log("Redirecionando usuario autenticado para /")
                self.error = false;
              } else {
                $location.path("/login");
                self.error = true;
              }
            });
        };
  
        $rootScope.logout = function() {
            $http.post('logout', {}).then(function() {
              $rootScope.authenticated = false;
              $location.path("/");
            });
          }
  
  });
  </code></pre>
  
  <p><a href="http://i.stack.imgur.com/mtq8m.jpg" rel="nofollow">Authenticating User</a></p>
  
  <p><a href="http://i.stack.imgur.com/e8O64.jpg" rel="nofollow">Trying to Logout</a></p>