title: Spring security csrf not working with spring-session
body: <p>I'm using spring-session version 1.0.0.M1 and I have configured it to use the <code>MapSessionRepository</code>:
          sessionFilterChainReg.addMappingForServletNames(EnumSet.of(DispatcherType.REQUEST), false, dispatcherServletReg.getName());</p>
  
  <pre><code>@Bean(name = {"defaultSessionFilter", "sessionFilter"})
  public SessionRepositoryFilter sessionFilter() {
      return new SessionRepositoryFilter((SessionRepository) applicationContext.getBean("sessionRepository"));
  }
  
  
  @Bean(name = { "defaultSessionRepository", "sessionRepository" })
  public SessionRepository defaultSessionRepository() {
      return new MapSessionRepository();
  }
  </code></pre>
  
  <p>and then in the web-config:</p>
  
  <pre><code>    final FilterRegistration sessionFilterChainReg = servletContext.addFilter("sessionFilter", DelegatingFilterProxy.class);
  </code></pre>
  
  <p>So I have in my register.jsp the following input hidden element:</p>
  
  <pre><code>&lt;input type="hidden" id="${_csrf.parameterName}" name="${_csrf.parameterName}" value="${_csrf.token}"/&gt;
  </code></pre>
  
  <p>And I can see the page gets rendered with a correct CSRF token. When I submit the POST request the CSRF filter is triggered and the token is passed correctly to the filter, which calls the <code>HttpSessionCsrfTokenRepository:loadToken</code> and in there on line 66 we see:</p>
  
  <pre><code>HttpSession session = request.getSession(false);
  </code></pre>
  
  <p>and now the session is null, so the repository returns a null CSRF token and then a <code>MissingCsrfTokenException</code> is thrown. Is there something else I need to configure?</p>
  
  <p>Here's the stacktrace when hitting line 66 (there's a lot more, but i guess this is the relevant part of it):</p>
  
  <pre><code>at org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository.loadToken(HttpSessionCsrfTokenRepository.java:66)
    at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:75)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.access.channel.ChannelProcessingFilter.doFilter(ChannelProcessingFilter.java:144)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:344)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:261)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1632)
    at org.springframework.session.web.SessionRepositoryFilter.doFilterInternal(SessionRepositoryFilter.java:83)
    at org.springframework.session.web.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:66)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:344)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:261)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1632)
  </code></pre>