title: Can't create CSRF token with Spring Security
body: <p>I am using Spring Security 3.2.3 in my Spring MVC application and getting some unexpected behavior. </p>
  
  <p>According to the <a href="http://docs.spring.io/spring-security/site/docs/3.2.0.CI-SNAPSHOT/reference/html/csrf.html">documentation here</a>, it should be possible to use <code>${_csrf.token}</code> in the meta tags of my html:</p>
  
  <pre><code>&lt;meta name="_csrf" content="${_csrf.token}" /&gt;
  &lt;!-- default header name is X-CSRF-TOKEN --&gt;
  &lt;meta name="_csrf_header" content="${_csrf.headerName}" /&gt;
  </code></pre>
  
  <p>From where I extract the value of "content" using JQuery and place it into the Request Header using AJAX.</p>
  
  <p>For some reason though, Spring Security doesn't "convert" this into an actual token, it just gets sent into the header as a literal string "${_csrf.token}".</p>
  
  <p>Trying the alternate route of using <code>${_csrf.token}</code> in a hidden input according to the documentation, I then tried to check what the token evaluates to by checking the input's value, but it's still just plain text "${_csrf.token}".</p>
  
  <p>Since it seems that Spring Security isn't in effect, am I missing some kind of configuration? I am currently using a barebones Spring Security Java configuration (as opposed to xml) as shown here: </p>
  
  <pre><code>import org.springframework.context.annotation.*;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.*;
  
  @Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
            .csrf();
        }
  }
  </code></pre>
  
  <p>I know configure is getting called since I put a debug statement in it, so I assume that CSRF protection is indeed enabled since it should be by default. </p>
  
  <p>I realize that the syntax "${}" is JSP Expression Language, and I am currently successfully using it to evaluate the context into an object with Thymeleaf, for example:</p>
  
  <pre><code>th:object="${context}"
  </code></pre>
  
  <p>So I tried adding "th:" in front of the meta tag's "content" like so:</p>
  
  <pre><code>&lt;meta name="_csrf" th:content="${_csrf.token}"/&gt;
  </code></pre>
  
  <p>But it results in an exception that this cannot be evaluated:</p>
  
  <blockquote>
    <p>Exception evaluating SpringEL expression: "_csrf.token"</p>
  </blockquote>
  
  <p>I think the key here may be figuring out how to get the expression to evaluate properly in my view.</p>