Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-CSRF-TOKEN'

Question

After configuring Spring Security 3.2, _csrf.token is not bound to a request or a session object.

This is the spring security config:

<http pattern="/login.jsp" security="none"/>

<http>
    <intercept-url pattern="/**" access="ROLE_USER"/>
    <form-login login-page="/login.jsp"
                authentication-failure-url="/login.jsp?error=1"
                default-target-url="/index.jsp"/>
    <logout/>
    <csrf />
</http>

<authentication-manager>
    <authentication-provider>
        <user-service>
            <user name="test" password="test" authorities="ROLE_USER/>
        </user-service>
    </authentication-provider>
</authentication-manager>

The login.jsp file

<form name="f" action="${contextPath}/j_spring_security_check" method="post" >
    <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
    <button id="ingresarButton"
            name="submit"
            type="submit"
            class="right"
            style="margin-right: 10px;">Ingresar</button>
    <span>
        <label for="usuario">Usuario :</label>
        <input type="text" name="j_username" id="u" class="" value=''/>
    </span>
    <span>
        <label for="clave">Contrase&ntilde;a :</label>

        <input type="password"
               name="j_password"
               id="p"
               class=""
               onfocus="vc_psfocus = 1;"
               value="">
    </span>
</form>

And it renders the next html:

<input type="hidden" name="" value="" />

The result is 403 HTTP status:

Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-CSRF-TOKEN'.

UPDATE After some debug, the request object gets out fine form DelegatingFilterProxy, but in the line 469 of CoyoteAdapter it executes request.recycle(); that erases all the attributes...

I test in Tomcat 6.0.36, 7.0.50 with JDK 1.7.

I have not understood this behavior, rather than, it would be possible if someone point me in the direction of some application sample war with Spring Security 3.2 that works with CSRF.

What Spring version do you use? This same thing works for me (there are differences however, in `spring-security.xml`) with Spring 4.0.0 RELEASE (GA), Spring Security 3.2.0 RELEASE (GA) (though it is integrated with Struts 2.3.16. I did not give it a try with Spring MVC alone). It however fails, when the request is **multipart** for uploading files with the status 403. I'm struggling to find a solution for it. — Tiny, Feb 02 '14 at 16:26
Spring 3.2.6, Spring Security 3.2.0, the CSRF, token was added to the http-request object, the session object is the same along with the request thread, but when go out until its renders the jsp remove all attributes and only leave an attribute ...filter_applied — Hugo Robayo, Feb 04 '14 at 02:27
@Tiny: Did you ever find a solution to the multipart problem? I'm having the _exact_ same issue. — Rob Johansen, Feb 26 '14 at 06:16
@AlienBishop : Yes, please check out [this](http://stackoverflow.com/a/21741353/1391249) answer (it uses a combination of Spring and Struts). If you have Spring MVC alone then, please check out [this](http://stackoverflow.com/a/21973656/1391249) answer. It should be noted that the order of filters in `web.xml` is crucial. `MultipartFilter` must be declared before `springSecurityFilterChain`. Hope that helps. Thanks. — Tiny, Feb 26 '14 at 11:46

MaVRoSCy · Answer 1 · 2019-03-28T09:00:38.810

It looks like the CSRF (Cross Site Request Forgery) protection in your Spring application is enabled. Actually it is enabled by default.

According to spring.io:

When should you use CSRF protection? Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-browser clients, you will likely want to disable CSRF protection.

So to disable it:

@Configuration
public class RestSecurityConfig extends WebSecurityConfigurerAdapter {
  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable();
  }
}

If you want though to keep CSRF protection enabled then you have to include in your form the csrftoken. You can do it like this:

<form .... >
  ....other fields here....
  <input type="hidden"  name="${_csrf.parameterName}"   value="${_csrf.token}"/>
</form>

You can even include the CSRF token in the form's action:

<form action="./upload?${_csrf.parameterName}=${_csrf.token}" method="post" enctype="multipart/form-data">

This should be accepted as the answer because it explains not only what to do, but also what you should consider before doing something to stop these errors. — Thomas Carlisle, Mar 26 '18 at 18:48
You can also do `.csrf().ignoringAntMatchers("/h2-console/**")` — insan-e, Jun 14 '18 at 09:15
In above answer avoid going via query parameter style. If you do this you are exposing tokens in public. — Pramod S. Nikam, May 08 '20 at 11:21

score 32 · Answer 2 · edited Jan 01 '18 at 13:58

32

Shouldn't you add to the login form?;

<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>

As stated in the here in the Spring security documentation

edited Jan 01 '18 at 13:58

asherbret

5,439
4
38
58

answered Jun 06 '14 at 15:50

borjab

11,149
6
71
98

score 12 · Answer 3 · edited Jun 12 '19 at 08:53

12

If you will apply security="none" then no csrf token will be generated. The page will not pass through security filter. Use role ANONYMOUS.

I have not gone in details, but it is working for me.

 <http auto-config="true" use-expressions="true">
   <intercept-url pattern="/login.jsp" access="hasRole('ANONYMOUS')" />
   <!-- you configuration -->
   </http>

edited Jun 12 '19 at 08:53

Sampada

2,931
7
27
39

answered Aug 09 '15 at 06:09

Awanish Kumar

640
8
15

I was using security=none and moving to your answer solved this issue. it is awesome thymeleaf automatically adds the csrf token. Thanks ! – rxx Mar 29 '16 at 18:39

score 7 · Answer 4 · answered May 09 '15 at 21:20

7

Try to change this: <csrf /> to this : <csrf disabled="true"/>. It should disable csfr.

answered May 09 '15 at 21:20

Arkadiusz Gibes

81
2
4

score 7 · Answer 5 · answered Oct 17 '16 at 17:05

7

With thymeleaf you may add:

<input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}"/>

answered Oct 17 '16 at 17:05

Lay Leangsros

9,156
7
34
39

score 6 · Answer 6 · answered Jan 13 '17 at 07:12

6

Spring documentation to disable csrf: https://docs.spring.io/spring-security/site/docs/current/reference/html/csrf.html#csrf-configure

@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {

   @Override
   protected void configure(HttpSecurity http) throws Exception {
      http.csrf().disable();
   }
}

answered Jan 13 '17 at 07:12

Rahul Raj

107
1
2

Don't copy existing answers, please. – james.garriss Jul 07 '17 at 14:27

xxg · Answer 7 · 2015-12-09T06:07:16.693

I used to have the same problem.

Your config use security="none" so cannot generate _csrf:

<http pattern="/login.jsp" security="none"/>

you can set access="IS_AUTHENTICATED_ANONYMOUSLY" for page /login.jsp replace above config：

<http>
    <intercept-url pattern="/login.jsp*" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
    <intercept-url pattern="/**" access="ROLE_USER"/>
    <form-login login-page="/login.jsp"
            authentication-failure-url="/login.jsp?error=1"
            default-target-url="/index.jsp"/>
    <logout/>
    <csrf />
</http>

score 2 · Answer 8 · answered Jun 14 '14 at 07:38

2

i think csrf only works with spring forms

<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>

change to form:form tag and see it that works.

answered Jun 14 '14 at 07:38

Saurabh Kumar

16,353
49
133
212

You dont need to use spring forms: http://docs.spring.io/spring-security/site/docs/3.2.7.RELEASE/reference/htmlsingle/#csrf-include-csrf-token – Bart Swennenhuis Apr 23 '15 at 08:30

score 1 · Answer 9 · answered Feb 10 '14 at 03:26

1

Please see my working sample application on Github and compare with your set up.

answered Feb 10 '14 at 03:26

manish

19,695
5
67
91

I will downgrade to spring 3.2.6, I hope it works without spring mvc. – Hugo Robayo Feb 11 '14 at 05:02
Yes, it should work without problems as I created the sample application out of my existing application that was on Spring 3.1.4. – manish Feb 11 '14 at 05:06
ha ha ha ha ha, great, to make it working just downgrading is not solution bhaiya ji @manish – Kuldeep Singh Dec 29 '16 at 19:56

vancho · Answer 10 · 2018-02-21T14:20:23.227

1

Neither one of the solutions worked form me. The only one that worked for me in Spring form is:

action="./upload?${_csrf.parameterName}=${_csrf.token}"

REPLACED WITH:

action="./upload?_csrf=${_csrf.token}"

(Spring 5 with enabled csrf in java configuration)

edited Feb 21 '18 at 14:20

answered Feb 21 '18 at 12:33

vancho

76
7

score 0 · Answer 11 · answered Jul 31 '17 at 22:35

0

In your controller add the following:

@RequestParam(value = "_csrf", required = false) String csrf

And on jsp page add

<form:form modelAttribute="someName" action="someURI?${_csrf.parameterName}=${_csrf.token}

answered Jul 31 '17 at 22:35

Taras Melnyk

3,057
3
38
34

Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-CSRF-TOKEN'

11 Answers11

Linked