title: CSRF token not generated with Webflux
body: <p>I have a Webflux application secured by Spring Security in which the CSRF protection is enabled by default. However, I can't get the the CSRF token to be saved in the session.</p>
  
  <p>After some investigations, I noticed that it may come from <code>WebSessionServerCsrfTokenRepository.class</code>. In this class, there is the <code>generateToken</code> method that should create a Mono from a generated CSRF token:</p>
  
  <pre><code>public Mono&lt;CsrfToken&gt; generateToken(ServerWebExchange exchange) {
          return Mono.fromCallable(() -&gt; {
              return this.createCsrfToken();
          });
      }
  
  private CsrfToken createCsrfToken() {
          return new DefaultCsrfToken(this.headerName, this.parameterName, this.createNewToken());
      }
  
      private String createNewToken() {
          return UUID.randomUUID().toString();
      }
  </code></pre>
  
  <p>However, even if the <code>generateToken</code> method is called by the <code>CsrfWebFilter</code>, the <code>createCsrfToken</code> method is never called, and I never get the CSRF token to be saved in the session. My breakpoint never goes into the <code>createCsrfToken</code> method, that could mean that it is never subscribed.</p>
  
  <p>I'm running on <code>Netty</code> with Spring Boot <code>2.1.0.RELEASE</code> and Spring Security <code>5.1.1.RELEASE</code>.</p>
  
  <p>I reproduced the problem on an empty sample application simply containing the following dependencies:</p>
  
  <pre><code>&lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-webflux&lt;/artifactId&gt;
          &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-oauth2-client&lt;/artifactId&gt;
          &lt;/dependency&gt;
  </code></pre>
  
  <p>Am I missing something or is there a problem with Spring Security?</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>From further investigations, I think that the problem comes from this method in the Spring Security <code>CsrfWebFilter.class</code>:</p>
  
  <pre><code>private Mono&lt;Void&gt; continueFilterChain(ServerWebExchange exchange, WebFilterChain chain) {
          return Mono.defer(() -&gt; {
              Mono&lt;CsrfToken&gt; csrfToken = this.csrfToken(exchange);
              exchange.getAttributes().put(CsrfToken.class.getName(), csrfToken);
              return chain.filter(exchange);
          });
      }
  </code></pre>
  
  <p>Here, the <code>csrfToken</code> Mono is never subscribed. When I rewrite the filter this way, I manage to get the token added in the session:</p>
  
  <pre><code>private Mono&lt;Void&gt; continueFilterChain(ServerWebExchange exchange, WebFilterChain chain) {
          return Mono.defer(() -&gt; {
              return this.csrfToken(exchange)
                      .map(csrfToken -&gt; exchange.getAttributes().put(CsrfToken.class.getName(), csrfToken))
                      .then(chain.filter(exchange));
          });
      }
  </code></pre>
  
  <p>However, the <code>_csrf</code> parameter is never added in my Thymeleaf model, so the following test doesn't work:</p>
  
  <pre><code>&lt;form name="test-csrf" action="/test" method="post"&gt;
              &lt;input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}" /&gt;
              &lt;button type="submit"&gt;Escape!&lt;/button&gt;
          &lt;/form&gt;
  </code></pre>