title: Spring not sending CSRF token on response
body: <p>I'm having problems getting my Angular2 client to communicate with my Spring server since I added spring-security to it, namely when I try to send a JSON containing authentication information to the server login url I get a 403 "Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-CSRF-TOKEN'." </p>
  
  <p>I understand that I should be passing a token on the header of my responses to be used by the client but this token isnt being passed. I tried <a href="https://stackoverflow.com/questions/27457442/how-to-configure-spring-security-to-send-x-csrf-token?rq=1">this answer</a> but the token is still not being passed. I'm also sending requests through postman, and the token isnt arriving either.</p>
  
  <p><code>webSecurityConfig.xml</code>:</p>
  
  <pre><code>    &lt;http entry-point-ref="restAuthenticationEntryPoint"&gt;
        &lt;intercept-url pattern="/api/**" access="hasRole('ROLE_USER')"/&gt;
  
        &lt;form-login
           authentication-success-handler-ref="mySuccessHandler"
           authentication-failure-handler-ref="myFailureHandler"
        /&gt;
  
        &lt;logout /&gt;
     &lt;/http&gt;
  
     &lt;beans:bean id="mySuccessHandler"
        class="com.eficid.cloud.security.rest.AuthenticationSuccessHandler"/&gt;
     &lt;beans:bean id="myFailureHandler" class=
       "org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"/&gt;
  
  
        &lt;authentication-manager&gt;
          &lt;authentication-provider&gt;
            &lt;user-service&gt;
              &lt;user name="temp" password="temp" authorities="ROLE_USER" /&gt;
            &lt;/user-service&gt;
          &lt;/authentication-provider&gt;
        &lt;/authentication-manager&gt;
  
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p><code>SpringSecurityConfiguration</code></p>
  
  <pre><code>@Configuration
  @ImportResource({ "classpath:webSecurityConfig.xml" })
  @ComponentScan("com.eficid.cloud.security.rest")
  public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
  
      public SpringSecurityConfig() {
          super();
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.httpBasic().and().authorizeRequests()
                  .antMatchers("/spring-security-rest/login").permitAll().anyRequest()
                  .authenticated().and().csrf()
                  .csrfTokenRepository(csrfTokenRepository()).and()
                  .addFilterAfter(csrfHeaderFilter(), CsrfFilter.class);
      }
  
  
      private Filter csrfHeaderFilter() {
          return new OncePerRequestFilter() {
              @Override
              protected void doFilterInternal(HttpServletRequest request,
                      HttpServletResponse response, FilterChain filterChain)
                      throws ServletException, IOException {
                  CsrfToken csrf = (CsrfToken) request.getAttribute(CsrfToken.class
                          .getName());
                  if (csrf != null) {
                      Cookie cookie = WebUtils.getCookie(request, "XSRF-TOKEN");
                      String token = csrf.getToken();
                      if (cookie == null || token != null
                              &amp;&amp; !token.equals(cookie.getValue())) {
                          cookie = new Cookie("XSRF-TOKEN", token);
                          cookie.setPath("/");
                          response.addCookie(cookie);
                      }
                  }
                  filterChain.doFilter(request, response);
              }
          };
      }
  
      private CsrfTokenRepository csrfTokenRepository() {
          HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
          repository.setHeaderName("X-XSRF-TOKEN");
          return repository;
      }
  
  }
  </code></pre>