title: Setting Owasp.CsrfGuard.properties in a Spring framework application
body: <p>I am adding OWASP.CsrfGuard.jar to my spring 3.2.4 application to prevent CSRF attacks, but I am not sure how to config it.
  The entry point of my application is</p>
  
  <p><a href="http://127.0.0.1:7001/devices/welcome.do" rel="nofollow">http://127.0.0.1:7001/devices/welcome.do</a></p>
  
  <p>From this controller ( WelcomeController ) depending of some conditions the view could be different:</p>
  
  <pre><code>....
  
      if (usr.getValidated().booleanValue() == Boolean.FALSE) {
                      return new ModelAndView("createAccountRedirectView");
                  } else {
                      if (usr.getUserRole().equals(UserRole.MARKETING_SALES_TEAM_MEMBER)) {
                          return new ModelAndView("listAccountsRedirectView");                                    
                      } else if (usr.getUserRole().equals(UserRole.MANAGER)) {
                          return new ModelAndView("redirectingManageView");
                      } else {
                          return new ModelAndView(getView());
                      }
                  }
      ....
  </code></pre>
  
  <p>Here my Owasp.CsrfGuard.properties :</p>
  
  <pre><code>org.owasp.csrfguard.Logger=org.owasp.csrfguard.log.ConsoleLogger
  org.owasp.csrfguard.NewTokenLandingPage=/devices/welcome.do
  org.owasp.csrfguard.TokenPerPage=true
  org.owasp.csrfguard.TokenPerPagePrecreate=false
  
  org.owasp.csrfguard.Ajax=true
  
  org.owasp.csrfguard.action.Log=org.owasp.csrfguard.action.Log
  org.owasp.csrfguard.action.Log.Message=potential cross-site request forgery (CSRF) attack thwarted (user:%user%, ip:%remote_ip%, uri:%request_uri%, error:%exception_message%)
  
  org.owasp.csrfguard.unprotected.Public=/devices/welcome.do
  
  org.owasp.csrfguard.TokenName=OWASP_CSRFTOKEN
  org.owasp.csrfguard.SessionKey=OWASP_CSRFTOKEN
  org.owasp.csrfguard.TokenLength=128
  org.owasp.csrfguard.PRNG=SHA1PRNG
  </code></pre>
  
  <p>and here the result in the console:</p>
  
  <pre><code>[Thu Oct 08 10:17:26 CEST 2015] [Info] CsrfGuard analyzing request /devices/welcome/welcome.do
  [Thu Oct 08 10:17:26 CEST 2015] [Info] CsrfGuard analyzing request /devices/welcome.do
  [Thu Oct 08 10:17:26 CEST 2015] [Error] potential cross-site request forgery (CSRF) attack thwarted (user:joanet, ip:12
  7.0.0.1, uri:/devices/welcome.do, error:required token is missing from the request)
  &lt;08-Oct-2015 10:17:31 o'clock CEST&gt; &lt;Warning&gt; &lt;Socket&gt; &lt;BEA-000449&gt; &lt;Closing the socket, as no data read from it on 127.
  0.0.1:54,138 during the configured idle timeout of 5 seconds.&gt;
  </code></pre>