title: Spring RestController requires CSRF
body: <p>I have built a RestController, which should help manage tags in a web application. I will be calling all of the methods through AJAX (using JQuery), but Spring-Boot's default Security results in the following (when calling from Postman):</p>
  
  <p>{
      "timestamp": 1438800538949,
      "status": 403,
      "error": "Forbidden",
      "message": "Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-CSRF-TOKEN'.",
      "path": "/tag/add"
  }</p>
  
  <p>What is the best way to get the CSRF token to do the calls from JQuery? I assume it's better than to disable it. What about when using it from PostMan?</p>
  
  <p>This is the code of the controller:</p>
  
  <pre><code>@RestController
  public class TagController {
  
  @Autowired
  private TagService tagService;
  
  @RequestMapping(name = "/tag/list", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)
  public ResponseEntity&lt;TagList&gt; getTagList() {
      TagList result = new TagList(tagService.list());
      return new ResponseEntity&lt;TagList&gt;(result, HttpStatus.OK);
  }
  
  @RequestMapping(name = "/tag/add", method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE)
  public ResponseEntity&lt;?&gt; addTag(@RequestBody AlterTagForm form) {
      try {
          tagService.addTag(form.getArticleId(), form.getTagName());
          return new ResponseEntity&lt;&gt;(HttpStatus.ACCEPTED);
      } catch (EntityNotFoundException ex) {
          return new ResponseEntity&lt;&gt;(HttpStatus.NOT_FOUND);
      }
  }
  
  @RequestMapping(name = "/tag/remove", produces = MediaType.APPLICATION_JSON_VALUE)
  public ResponseEntity&lt;?&gt; removeTag(@RequestBody AlterTagForm form) {
      try {
          tagService.removeTag(form.getArticleId(), form.getTagName());
          return new ResponseEntity&lt;&gt;(HttpStatus.ACCEPTED);
      } catch (EntityNotFoundException ex) {
          return new ResponseEntity&lt;&gt;(HttpStatus.NOT_FOUND);
      }
  }
  }
  </code></pre>