title: Using AngularJS with SpringSecurity3.2 for CSRF
body: <p><strong>AngularJS</strong></p>
  
  <p><strong>index.html</strong></p>
  
  <pre><code>&lt;head&gt;
      &lt;meta name="_csrf" content="${_csrf.token}"/&gt;
      &lt;!-- default header name is X-CSRF-TOKEN --&gt;
      &lt;meta name="_csrf_header" content="${_csrf.headerName}"/&gt;
  &lt;/head&gt;
  </code></pre>
  
  <p><strong>SpringSecurity 3.2</strong></p>
  
  <p>Spring uses <strong>HttpSessionCsrfTokenRepository</strong> which by default gives header name for CSRF as  <strong>X-CSRF-TOKEN</strong>, however Anuglar convention is  <strong>X-XSRF-TOKEN</strong></p>
  
  <p>I wanted to extend <strong>HttpSessionCsrfTokenRepository</strong> and override the header name, but since it is marked final I ended up implementing a custom token repository.</p>
  
  <pre><code>@Component
  public class CustomCsrfTokenRepository implements CsrfTokenRepository {
  
    public static final String CSRF_PARAMETER_NAME = "_csrf";
  
    public static final String CSRF_HEADER_NAME = "X-XSRF-TOKEN";
  
    private final Map&lt;String, CsrfToken&gt; tokenRepository = new ConcurrentHashMap&lt;&gt;();
  
    public CustomCsrfTokenRepository() {
      log.info("Creating {}", CustomCsrfTokenRepository.class.getSimpleName());
    }
  
    @Override
    public CsrfToken generateToken(HttpServletRequest request) {
      return new DefaultCsrfToken(CSRF_HEADER_NAME, CSRF_PARAMETER_NAME, createNewToken());
    }
  
    @Override
    public void saveToken(CsrfToken token, HttpServletRequest request, HttpServletResponse response) {
      String key = getKey(request);
      if (key == null)
        return;
  
      if (token == null) {
        tokenRepository.remove(key);
      } else {
        tokenRepository.put(key, token);
      }
    }
  
    @Override
    public CsrfToken loadToken(HttpServletRequest request) {
      String key = getKey(request);
      return key == null ? null : tokenRepository.get(key);
    }
  
    private String getKey(HttpServletRequest request) {
      return request.getHeader("Authorization");
    }
  
    private String createNewToken() {
      return UUID.randomUUID().toString();
    }
  }
  </code></pre>
  
  <p><strong>SecurityConfig.java</strong>   </p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Inject
      private CustomCsrfTokenRepository customCsrfTokenRepository;
  
  
       @Override
          protected void configure(HttpSecurity http) throws Exception {
  
              http
      //          .addFilterAfter(new CsrfTokenGeneratorFilter(), CsrfFilter.class)
                  .exceptionHandling()
                      .authenticationEntryPoint(authenticationEntryPoint)
                      .and()
                  .formLogin()
                      .loginProcessingUrl("/app/authentication")
                      .successHandler(ajaxAuthenticationSuccessHandler)
                      .failureHandler(ajaxAuthenticationFailureHandler)
                      .usernameParameter("j_username")
                      .passwordParameter("j_password")
                      .permitAll()
                      .and()
  
                   .csrf()
                      .csrfTokenRepository(customCsrfTokenRepository)
                      .and()
                }
             }
  </code></pre>
  
  <ol>
  <li><p>How can I cleanly override the header name instead of creating a custom csrfTokenRepository?</p></li>
  <li><p>Is there any other configuration changes I need to do for Single Page
  Applications such as AngularJS, as this does not work yet.</p></li>
  </ol>