title: Spring Cloud Gateway POST Forbidden
body: <p>I have a resource service behind Cloud Gateway route with RelayToken filter:</p>
  
  <pre><code>      routes:
          - id: apis
            uri: http://rest-app:8080/apis
            predicates:
              - Path=/apis/**
            filters:
              - TokenRelay=
  </code></pre>
  
  <p>GET requests work fine, but on POSTs I get 403 Forbidden with response body containing
  <code>CSRF Token has been associated to this client</code>
  I've tried to disable CSRF protection adding <code>Bean</code></p>
  
  <pre><code>@Bean
  fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
      return http.csrf().disable().cors().disable().build()
  }
  </code></pre>
  
  <p>But this has no effect and I still get 403. Moreover I cannot debug which exactly filter prevents client from doing POST requests, the only logging information I get with</p>
  
  <pre><code>logging:
    level:
      root: INFO
      org.springframework.web: TRACE
      org.springframework.security: TRACE
      org.springframework.security.oauth2: TRACE
      org.springframework.cloud.gateway: TRACE
      org.springframework.security.jwt: TRACE
  </code></pre>
  
  <p>is just couple of lines saying POST was forbidden</p>
  
  <pre><code>[2020-04-01 13:21:32,635] TRACE o.s.w.s.a.HttpWebHandlerAdapter  - [58a0e540-10] HTTP POST "/apis/", headers={masked} 
  [2020-04-01 13:21:32,640] TRACE o.s.w.s.a.HttpWebHandlerAdapter  - [58a0e540-10] Completed 403 FORBIDDEN, headers={masked} 
  [2020-04-01 13:21:32,640] TRACE o.s.h.s.r.ReactorHttpHandlerAdapter  - [58a0e540-10] Handling completed 
  </code></pre>
  
  <p>How do I correctly turn CSRF off?</p>