Spring Security - Third Edition

Including the CSRF token using the Spring Security JSP tag library

If CSRF protection is enabled, this tag inserts a hidden form field with the correct name and value for the CSRF protection token. If CSRF protection is not enabled, this tag has no output.

Normally, Spring Security automatically inserts a CSRF form field for any <form:form> tags you use, but if for some reason you cannot use <form:form>, csrfInput is a handy replacement.

You should place this tag within an HTML <form></form> block, where you would normally place other input fields. Do not place this tag within a Spring <form:form></form:form> block. Spring Security handles Spring forms automatically as follows:

    <form method="post" action="/logout">      <sec:csrfInput /> ... ...