title: Expected CSRF token not found. Has your session expired? + Spring security + CSRF
body: <p>I am trying to implement CSRF via spring security.</p>
  
  <p>But, facing <strong>following error</strong> in browser, after clicking login button(from home.jsp) </p>
  
  <p><strong>"Expected CSRF token not found. Has your session expired?"</strong></p>
  
  <p>I have following configuration in </p>
  
  <p>spring-security-config.xml:</p>
  
  <pre><code>&lt;http auto-config="false"&gt;
  &lt;csrf/&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>home.jsp:</p>
  
  <pre><code>&lt;form action="j_spring_security_check" id="LoginForm" method="post"&gt;       
      &lt;input type="text" title="Username" name="j_username" id="j_username" 
             class="inset-shadow defaultText" placeholder="Username" /&gt;
      &lt;input type="password" title="Password" name="j_password" 
             id="j_password" class="inset-shadow defaultText" placeholder="Password" /&gt;
      &lt;input type="submit" class="submit" title="LOGIN" 
             onsubmit="javascript:{loginSubmit();}"/&gt;
      &lt;input type="hidden" name="_csrf" value="dc7ce2be-f73b-4086-8f90-8ef00b8f81d5"/&gt;    
  &lt;/form&gt;
  </code></pre>
  
  <p>Error from jboss server.log:</p>
  
  <pre>
  2015-09-14 19:56:10,221 ERROR [org.apache.catalina.core.ContainerBase.[jboss.web].[localhost].[/].[jsp]] (http-127.0.0.1-8190-2) Servlet.service() for servlet jsp threw exception: java.lang.IllegalStateException: getAttribute: Session already invalidated
      at org.apache.catalina.session.StandardSession.getAttribute(StandardSession.java:1024) [:6.1.0.Final]
      at org.apache.catalina.session.StandardSessionFacade.getAttribute(StandardSessionFacade.java:110) [:6.1.0.Final]
      at org.apache.jsp.WEB_002dINF.jsp.home_jsp._jspService(home_jsp.java:99)
  </pre>
  
  <p><strong>Note : Not sure whether the error from server.log relates to CSRF</strong></p>
  
  <p>Any help on this problem is highly appreciated?</p>