title: Tomcat 8.5 anti-CSRF nonce not being generated
body: <p>I have a web application that runs on Tomcat 8.5. I would like to update the application to rely on Tomcats native anti-CSRF tokens to protect key POST requests on the web app. I have done quite of bit of researched and followed a number of example yet I still cannot seem to get this to work.</p>
  
  <p>web.xml:</p>
  
  <pre><code>&lt;filter&gt;
      &lt;filter-name&gt;CSRFPreventionFilter&lt;/filter-name&gt;
      &lt;filter-class&gt; org.apache.catalina.filters.CsrfPreventionFilter &lt;/filter-class&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;entryPoints&lt;/param-name&gt;
          &lt;param-value&gt;appNameRemoved/login.jsp&lt;/param-value&gt;
      &lt;/init-param&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;CSRFPreventionFilter&lt;/filter-name&gt;
      &lt;url-pattern&gt;/appNameRemoved/folder1/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>So at face value this appears to work. Any attempt to access a URL inside of folder1 is denied with a 403 (good). The issue arises when I try to generate the nonce value to allow authorized parties to access the privileaged area. </p>
  
  <p>In my main.jsp (JSP opened after logging in on entry-point login.jsp), I have the following Java code to try to generate the nonce value:</p>
  
  <pre><code>String antiCSRF = response.encodeURL("/appNameRemoved/folder1/delete");
  </code></pre>
  
  <p>The issue is, the value generated is simply </p>
  
  <pre><code>"/appNameRemoved/folder1/delete" 
  </code></pre>
  
  <p>rather than an expected URL (as seen by other peoples examles) such as:</p>
  
  <pre><code>"/appNameRemoved/folder1/delete?org.apache.catalina.filters.CSRF_NONCE=CB5C65E1D87A39D5557D6BCBC24E54A9"
  </code></pre>
  
  <p>Hence my question, why is response.encodeURL() not actually encoding the URL with the nonce value even though as far as I can see, the filter is setup correctly and checking for nonce's when accessing the privileged URL's.</p>
  
  <p>Thanks!</p>