title: Spring CSRF protection for login only
body: <p>I'm using Spring for a webapplication's backend, and will be using Angular for frontend. I'm trying to use CSRF protection for the login only, following 
  <a href="https://sdqali.in/blog/2016/07/20/csrf-protection-with-spring-security-and-angular-js/" rel="nofollow noreferrer">this guide</a> with some modification. What I'm trying to achieve is, that Angular first ajaxing to "/init" which will set the CSRF TOKEN cookie, then it can call the login, which is CSRF protected.</p>
  
  <p>When I'm calling the /init method, it gives back a CSRF token, however after that when I'm calling /login I keep getting 403 forbidden.</p>
  
  <p>Here's the request (using Postman for testing purposes): </p>
  
  <pre><code>POST /login HTTP/1.1
  Host: localhost:8080
  Accept: application/json
  Content-Type: application/json
  Cache-Control: no-cache
  
  {"username":"test","password":"test"}
  </code></pre>
  
  <p>Here's the java code for the csrf:</p>
  
  <pre><code>    private RequestMatcher csrfRequestMatcher = new RequestMatcher() {
  
      private RegexRequestMatcher requestMatcher =
              new RegexRequestMatcher("/login", null);
  
      @Override
      public boolean matches(HttpServletRequest request) {
          return requestMatcher.matches(request);
      }
  
  };
      @Override
  protected void configure(HttpSecurity http) throws Exception {
  
      http.csrf()
              .requireCsrfProtectionMatcher(csrfRequestMatcher)
              .and()
              .exceptionHandling().authenticationEntryPoint(authenticationEntryPoint)
              .and().authorizeRequests().antMatchers("/test/**").authenticated()
              .and().addFilterAt(MyUsernamePasswordAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)
              .formLogin().permitAll()
              .and().logout().logoutSuccessHandler(MyLogoutHandler())
              .and().addFilterAfter(new CsrfGrantingFilter(), SessionManagementFilter.class);
  }
  
  
  
  
  public class CsrfGrantingFilter implements Filter {
  
  @Override
  public void init(FilterConfig filterConfig) throws ServletException {}
  
  @Override
  public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
          throws IOException, ServletException {
      CsrfToken csrf = (CsrfToken) servletRequest.getAttribute(CsrfToken.class.getName());
      String token = csrf.getToken();
      if (token != null &amp;&amp; isInit(servletRequest)) {
          HttpServletResponse response = (HttpServletResponse) servletResponse;
          Cookie cookie = new Cookie("XSRF-TOKEN", token);
          cookie.setPath("/");
          response.addCookie(cookie);
      }
      filterChain.doFilter(servletRequest, servletResponse);
  }
  
  private boolean isInit(ServletRequest servletRequest) {
      HttpServletRequest request = (HttpServletRequest) servletRequest;
      return request.getRequestURI().equals("/init");
  }
  
  @Override
  public void destroy() {}
  }
  </code></pre>
  
  <p>Am I missing something obvious? Or is just my request bad?</p>