title: Spring Security CSRF Token not working with AJAX call & form submit in same JSP
body: <p>I am trying to implement spring security (ver 3.2.3) CSRF token in my project  by referring below links</p>
  
  <p><a href="http://docs.spring.io/autorepo/docs/spring-security/4.0.0.CI-SNAPSHOT/reference/htmlsingle/#csrf" rel="nofollow">http://docs.spring.io/autorepo/docs/spring-security/4.0.0.CI-SNAPSHOT/reference/htmlsingle/#csrf</a>
  <a href="http://docs.spring.io/autorepo/docs/spring-security/4.0.0.CI-SNAPSHOT/reference/htmlsingle/#the-csrfmetatags-tag" rel="nofollow">http://docs.spring.io/autorepo/docs/spring-security/4.0.0.CI-SNAPSHOT/reference/htmlsingle/#the-csrfmetatags-tag</a> </p>
  
  <p>I am able to integrate CSRF token in JSP successfully without AJAX call.
  But when I tried JSP with AJAX call, getting 'invalid CSRF token exception'.
  After my analysis I found for  both AJAX call &amp; form submission using same token due to this i am getting 'invalid CSRF token exception'.</p>
  
  <p>Could please any one help me to get raid of this issue. Is there any way to to generate two tokens i.e. one for AJAX call &amp; one for form submission</p>
  
  <p>security.xml</p>
  
  <p></p>
  
  <pre><code>    &lt;access-denied-handler ref="accessDenied" /&gt;
  
      &lt;intercept-url pattern="/**"  access="ROLE_1" /&gt;
  
      &lt;form-login  default-target-url='/loginUser.htm' always-use-default-target='true' authentication-failure-url='/forms/common/login.jsp?error=true' /&gt;
  
      &lt;logout logout-success-url="/forms/common/logout.jsp" invalidate-session="true" delete-cookies="JSESSIONID" /&gt;
  
      &lt;session-management invalid-session-url="/forms/common/sessionexpired.jsp" session-authentication-error-url="/forms/common/login.jsp?Error=alreadyLoggedin" &gt;
  
          &lt;concurrency-control expired-url="/forms/common/sessionexpired.jsp" max-sessions="1" error-if-maximum-exceeded="true" /&gt;
  
      &lt;/session-management&gt;
  
      &lt;csrf request-matcher-ref="csrfSecurityRequestMatcher"/&gt;
  &lt;/http&gt;
  
  &lt;beans:bean class="com.concerto.pg.login.security.CsrfSecurityRequestMatcher" id="csrfSecurityRequestMatcher"/&gt; 
  </code></pre>
  
  <p>JSP</p>
  
  <pre><code>&lt;head&gt;
  
  &lt;sec:csrfMetaTags /&gt;
  
  &lt;script type="text/javascript" charset="utf-8"&gt;
  
  function changeList(id,option){ 
  
      var csrfParameter = $("meta[name='_csrf_parameter']").attr("content");
      var csrfToken = $("meta[name='_csrf']").attr("content"); 
  
      var institution = document.getElementById("institutionId").value; 
      var data = {};
  
      data[csrfParameter] = csrfToken;
      data["institutionId"] = option;
  
   if(id=="institutionId"){
  
      var result ='';
  
                 $.ajax({
                       type: "GET",
                       async: false,
                        url: './getMerchantByInstitution.htm',
                       data: data,//"institutionId=" + option,
                       dataType:'json',
                       success: function (res) {
                       result = res;     
                           var htmlVar = '';
                              for (var i=0; i&lt;result.length; i++){
                                  htmlVar += '&lt;option 
                                  value="'+result[i]+'"&gt;'+result[i]+'&lt;/option&gt;';                              
                              }
                              htmlVar += '&lt;option value="ALL"&gt;ALL&lt;/option&gt;';
                               $('#merchantId').html(htmlVar);
                       }
                   }); 
  
  
  
      }
  
  }
  
  &lt;/script&gt;
  &lt;/head&gt;
  </code></pre>
  
  <pre>added below &lt input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" /&gt statement in form tag </pre>
  
  <p>Thanks &amp; Regards,
  Siva</p>