title: Custom CSRF filter for Spring Security doesn't ignore my /login
body: <p>I'm currently coding the security for a REST enterprise web application and when I finally got a custom CSRF filter work, I realised I can't POST anything into my /login because I need the CSRF token (a GET is possible though). The thing is, how can I retrieve for the first time the token so I can add it into the POST form that goes to the login?</p>
  
  <p>I'm using postman as my REST client and the only way I can get the token is first doing a dummy GET so I can retrieve the token and then add it into the POST, but I'm here assuming this could not be like this.</p>
  
  <p>I'm new to web security, csrf and also am not a front end developer, so the problem could lay there. </p>
  
  <p>P.D: My security:</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
  
      http    
          .addFilterAfter(new CsrfTokenResponseHeaderBindingFilter(), CsrfFilter.class)
          .authorizeRequests()
          .antMatchers("/login").permitAll().anyRequest().authenticated();
  
      http
          .formLogin().loginPage("/login").permitAll().successHandler(authenticationSuccessHandler)
          .failureHandler(authenticationFailureHandler)
          .and()
          .rememberMe().rememberMeParameter("remember-me").tokenValiditySeconds(2000)
          .and()
          .exceptionHandling().authenticationEntryPoint(authenticationEntryPoint)
          .and()
          .sessionManagement().maximumSessions(1);
  
  }
  </code></pre>
  
  <p>Also tried this one, but no good:</p>
  
  <pre><code> @Override
  public void configure(WebSecurity webSecurity) throws Exception
  {
      webSecurity
          .ignoring().antMatchers("/login").anyRequest();
  
  }
  </code></pre>
  
  <p>I'm using this custom filter, credits to the author: <a href="https://github.com/aditzel/spring-security-csrf-filter" rel="nofollow">https://github.com/aditzel/spring-security-csrf-filter</a> </p>
  
  <p>P.D.2: In case I wasn't clear enough, I want to login using a POST without doing the dummy get first. I don't know if is a code problem or a conceptual (security related) problem.</p>