title: InMemoryAuthentication cannot verify the provided CSRF token and return Whitelabel error page
body: <p>In a Spring Boot securityproject I get a Whitelabel Error Page when trying to be redirected from the login (after typed username and password) to the chosen page. The details are if I begin with the views that are jsp-files.
  The <code>start.jsp</code> only have one purpose, to redirect to <code>test.jsp</code></p>
  
  <pre><code>&lt;%@ page language="java" contentType="text/html; charset=ISO-8859-1"
      pageEncoding="ISO-8859-1"%&gt;
  &lt;!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" 
      "http://www.w3.org/TR/html4/loose.dtd"&gt;
  &lt;html&gt;
      &lt;head&gt;
          &lt;meta http-equiv="Content-Type" content="text/html; charset=ISO-
              8859-1"&gt;
          &lt;title&gt;Startpage&lt;/title&gt;
      &lt;/head&gt;
      &lt;body&gt;
          &lt;p&gt;Click &lt;a href="/test"&gt;here&lt;/a&gt; Start.&lt;/p&gt;
      &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>The securitysetting for <code>start.jsp</code> is permitAll and the setting for <code>test.jsp</code> is authenticated so before <code>test.jsp</code> <code>login.jsp</code> will be called to type username and password</p>
  
  <pre><code>&lt;%@ page language="java" contentType="text/html; charset=ISO-8859-1"
      pageEncoding="ISO-8859-1"%&gt;
  &lt;!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" 
      "http://www.w3.org/TR/html4/loose.dtd"&gt;
  &lt;html&gt;
      &lt;head&gt;
          &lt;meta http-equiv="Content-Type" content="text/html; charset=ISO-
              8859-1"&gt;
         &lt;title&gt;Login&lt;/title&gt;
      &lt;/head&gt;
      &lt;body&gt;
  
          &lt;form method="POST" action="/login"&gt;
              User Name : &lt;input type="text" name="username"/&gt;
              Password: &lt;input type="password" name="password"/&gt;
              &lt;button type="submit"&gt;Submit&lt;/button&gt;
          &lt;/form&gt;
      &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>and the endpage <code>test.jsp</code> looks like this</p>
  
  <pre><code>&lt;%@ page language="java" contentType="text/html; charset=ISO-8859-1"
      pageEncoding="ISO-8859-1"%&gt;
  &lt;!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" 
       "http://www.w3.org/TR/html4/loose.dtd"&gt;
  &lt;html&gt;
      &lt;head&gt;
          &lt;meta http-equiv="Content-Type" content="text/html; charset=ISO-
              8859-1"&gt;
          &lt;title&gt;Insert title here&lt;/title&gt;
      &lt;/head&gt;
      &lt;body&gt;
          Hi
      &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>The errormessage is</p>
  
  <blockquote>
    <p>Whitelabel Error Page
    This application has no explicit mapping for /error, so you are seeing this as a fallback.
    Thu Mar 01 21:43:40 CET 2018
    There was an unexpected error (type=Forbidden, status=403).
    Could not verify the provided CSRF token because your session was not found.</p>
  </blockquote>
  
  <p>It is run on my localhost as a http without any ssl or any other securitysettings chosen except for the Spring Boot Securitydependency in the pom.xml-file. </p>
  
  <pre><code>&lt;dependency&gt;
      &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
  &lt;/dependency&gt;
  </code></pre>
  
  <p>The Mvc is handled by </p>
  
  <pre><code>package com.proj.db_proj;
  
  import org.springframework.context.annotation.Configuration;
  import 
    org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
  import 
   org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
  
  @Configuration
  public class MvcConfig extends WebMvcConfigurerAdapter {
  
      @Override
      public void addViewControllers(ViewControllerRegistry registry) {
          registry.addViewController("/login").setViewName("login");
          registry.addViewController("/startpage").setViewName("startpage");
          registry.addViewController("/test").setViewName("test");
          registry.addViewController("/").setViewName("start");
      }
  }
  </code></pre>
  
  <p>and the Websecurity with the authentication and configuration </p>
  
  <pre><code>package com.proj.db_proj;
  
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.security.config.annotation.authentication.
      builders.AuthenticationManagerBuilder;
  import org.springframework.security.config.annotation.
      web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.
      web.configuration.EnableWebSecurity;
  import org.springframework.security.config.annotation.¨
      web.configuration.WebSecurityConfigurerAdapter;
  
  @Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
       @Override
           protected void configure(HttpSecurity http) throws Exception {
              http
                  .authorizeRequests()
                      .antMatchers("/", "/start").permitAll()
                      .anyRequest().authenticated()
                      .and()
                  .formLogin()
                      .loginPage("/login")
                      .permitAll()
                      .and()
                  .logout()
                      .permitAll();
          }
  
          @Autowired
          public void configureGlobal(AuthenticationManagerBuilder auth) 
              throws Exception {
              auth
                  .inMemoryAuthentication()
                  .withUser("user").password("user").roles("USER");
          }
  
   }
  </code></pre>
  
  <p>Anyone can see any error or know why I get the Whitelabel error page? I have followed manuals and checked tutorials and also questions here on stackoverflow without any answers.</p>