Spring Security - Third Edition

Including the CSRF token in the <Form> submissions

The last step is to ensure that you include the CSRF token in all PATCH, POST, PUT, and DELETE methods. One way to approach this is to use the _csrf request attribute to obtain the current CsrfToken token. An example of doing this with a JSP is shown as follows:

    <c:url var="logoutUrl" value="/logout"/>    <form action="${logoutUrl}" method="post">      <input type="submit" value="Log out" />      <input type="hidden"name="${_csrf.parameterName}" value="${_csrf.token}"/>    </form>