title: How to automatically generate csrf tokens in spring security / thymeleaf without using @EnableWebMvcSecurity
body: <p>I've been trying to figure out why the hidden csrf field is not automatically added to my login form.
  I'm using Spring 4.1.1 with Spring Security 4.0.1 and Thymeleaf 2.1.4.</p>
  
  <p>All I can find to fix the issue is to either use the _csrf variable in thymeleaf to add the field manually (although _csrf is null for me), or use @EnableWebMvcSecurity in Java config.
  However, I am using xml to configure security and would like to keep it that way.
  What it all boils down to is: What can I add to the security xml to make the thymeleaf generate the csrf token field?</p>
  
  <p>My current configuration is:</p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:context="http://www.springframework.org/schema/context"
         xmlns:mvc="http://www.springframework.org/schema/mvc"
         xmlns:security="http://www.springframework.org/schema/security"
         xsi:schemaLocation="
          http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
          http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
          http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd
          http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd"&gt;
  
      &lt;!-- **************************************************************** --&gt;
      &lt;!--  RESOURCE FOLDERS CONFIGURATION                                  --&gt;
      &lt;!--  Dispatcher configuration for serving static resources           --&gt;
      &lt;!-- **************************************************************** --&gt;
      &lt;mvc:resources mapping="/dist/**" location="file:/var/www/meubelplan/dist/"/&gt;
      &lt;mvc:resources mapping="/css/**" location="file:/var/www/meubelplan/css/"/&gt;
      &lt;mvc:resources mapping="/js/**" location="file:/var/www/meubelplan/js/"/&gt;
      &lt;mvc:resources mapping="/images/**" location="file:/var/www/meubelplan/images/"/&gt;
  
      &lt;!-- **************************************************************** --&gt;
      &lt;!--  SPRING ANNOTATION PROCESSING                                    --&gt;
      &lt;!-- **************************************************************** --&gt;
      &lt;mvc:annotation-driven/&gt;
      &lt;context:component-scan base-package="com.wwk.meubelplan"/&gt;
  
      &lt;!-- **************************************************************** --&gt;
      &lt;!--  SPRING SECURITY                                                 --&gt;
      &lt;!-- **************************************************************** --&gt;
  
      &lt;security:authentication-manager&gt;
          &lt;security:authentication-provider&gt;
              &lt;security:user-service&gt;
                  &lt;security:user name="sem" password="rtyfghvbn" authorities="ROLE_USER" /&gt;
                  &lt;security:user name="winnie" password="ikbenwinnie" authorities="ROLE_USER" /&gt;
              &lt;/security:user-service&gt;
          &lt;/security:authentication-provider&gt;
      &lt;/security:authentication-manager&gt;
  
      &lt;security:http pattern="/account/login" security="none"/&gt;
      &lt;security:http pattern="/account/logout" security="none"/&gt;
      &lt;security:http pattern="/account/create" security="none"/&gt;
      &lt;security:http use-expressions="false"&gt;
          &lt;security:csrf/&gt;
          &lt;security:intercept-url pattern='/account/**' access='ROLE_USER' /&gt;
          &lt;security:form-login login-page='/account/login' default-target-url='/account' always-use-default-target='true'/&gt;
          &lt;security:logout logout-url="/account/logout" delete-cookies="JSESSIONID" logout-success-url="/account/login"/&gt;
      &lt;/security:http&gt;
  
      &lt;!-- **************************************************************** --&gt;
      &lt;!--  THYMELEAF-SPECIFIC ARTIFACTS                                    --&gt;
      &lt;!--  TemplateResolver &lt;- TemplateEngine &lt;- ViewResolver              --&gt;
      &lt;!-- **************************************************************** --&gt;
  
      &lt;bean id="templateResolver"
            class="org.thymeleaf.templateresolver.FileTemplateResolver"&gt;
          &lt;property name="prefix" value="/var/www/meubelplan/" /&gt;
          &lt;property name="suffix" value=".html" /&gt;
          &lt;property name="templateMode" value="HTML5" /&gt;
          &lt;property name="characterEncoding" value="UTF-8" /&gt;
          &lt;property name="cacheable" value="false"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="templateEngine"
            class="org.thymeleaf.spring4.SpringTemplateEngine"&gt;
          &lt;property name="templateResolver" ref="templateResolver" /&gt;
      &lt;/bean&gt;
  
      &lt;bean class="org.thymeleaf.spring4.view.ThymeleafViewResolver"&gt;
          &lt;property name="templateEngine" ref="templateEngine" /&gt;
          &lt;property name="characterEncoding" value="UTF-8" /&gt;
      &lt;/bean&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p>My thymeleaf template for the form is:</p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org"&gt;
  &lt;head th:include="partials/general/head"&gt;&lt;/head&gt;
  &lt;body&gt;
  
      &lt;div class="container"&gt;
  
          &lt;nav th:replace="partials/general/navbar"&gt;&lt;/nav&gt;
  
          &lt;div th:replace="partials/general/logobar"&gt;&lt;/div&gt;
  
          &lt;div class="row"&gt;
              &lt;div class="col-md-6 col-md-offset-3"&gt;
  
                  &lt;br/&gt;&lt;br/&gt;
  
                  &lt;div class="panel panel-default"&gt;
                      &lt;div class="panel-heading"&gt;Login om uw account gegevens te bekijken&lt;/div&gt;
                      &lt;div class="panel-body"&gt;
                          &lt;form name="loginForm" method="POST" th:action="@{'~/account'}"&gt;
                              &lt;div class="form-group"&gt;
                                  &lt;label for="username"&gt;Email address&lt;/label&gt;
                                  &lt;input type="text" class="form-control" id="username" name="username" placeholder="Gebruikersnaam"/&gt;
                              &lt;/div&gt;
                              &lt;div class="form-group"&gt;
                                  &lt;label for="password"&gt;Password&lt;/label&gt;
                                  &lt;input type="password" class="form-control" id="password" name="password" placeholder="Password"/&gt;
                              &lt;/div&gt;
                              &lt;button type="submit" class="btn btn-default" value="Submit"&gt;Inloggen&lt;/button&gt;
                          &lt;/form&gt;
                      &lt;/div&gt;
                  &lt;/div&gt;
  
              &lt;/div&gt;
          &lt;/div&gt;
  
      &lt;/div&gt;&lt;!-- /.container --&gt;
  
      &lt;span th:replace="partials/general/scripts"&gt;&lt;/span&gt;
  
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>Thanks in advance for any pointers in the right direction :)</p>
  
  <p>Regards,</p>
  
  <p>Sem</p>