Spring not sending CSRF token on response
<p>I'm having problems getting my Angular2 client to communicate with my Spring server since I added spring-security to it, namely when I try to send a JSON containing authentication information to the server login url I get a 403 "Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-CSRF-TOKEN'." </p>

<p>I understand that I should be passing a token on the header of my responses to be used by the client but this token isnt being passed. I tried <a href="https://stackoverflow.com/questions/27457442/how-to-configure-spring-security-to-send-x-csrf-token?rq=1">this answer</a> but the token is still not being passed. I'm also sending requests through postman, and the token isnt arriving either.</p>

<p><code>webSecurityConfig.xml</code>:</p>

<pre><code>    &lt;http entry-point-ref="restAuthenticationEntryPoint"&gt;
      &lt;intercept-url pattern="/api/**" access="hasRole('ROLE_USER')"/&gt;

      &lt;form-login
         authentication-success-handler-ref="mySuccessHandler"
         authentication-failure-handler-ref="myFailureHandler"
      /&gt;

      &lt;logout /&gt;
   &lt;/http&gt;

   &lt;beans:bean id="mySuccessHandler"
      class="com.eficid.cloud.security.rest.AuthenticationSuccessHandler"/&gt;
   &lt;beans:bean id="myFailureHandler" class=
     "org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"/&gt;


      &lt;authentication-manager&gt;
        &lt;authentication-provider&gt;
          &lt;user-service&gt;
            &lt;user name="temp" password="temp" authorities="ROLE_USER" /&gt;
          &lt;/user-service&gt;
        &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;

&lt;/beans:beans&gt;
</code></pre>

<p><code>SpringSecurityConfiguration</code></p>

<pre><code>@Configuration
@ImportResource({ "classpath:webSecurityConfig.xml" })
@ComponentScan("com.eficid.cloud.security.rest")
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {

    public SpringSecurityConfig() {
        super();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.httpBasic().and().authorizeRequests()
                .antMatchers("/spring-security-rest/login").permitAll().anyRequest()
                .authenticated().and().csrf()
                .csrfTokenRepository(csrfTokenRepository()).and()
                .addFilterAfter(csrfHeaderFilter(), CsrfFilter.class);
    }


    private Filter csrfHeaderFilter() {
        return new OncePerRequestFilter() {
            @Override
            protected void doFilterInternal(HttpServletRequest request,
                    HttpServletResponse response, FilterChain filterChain)
                    throws ServletException, IOException {
                CsrfToken csrf = (CsrfToken) request.getAttribute(CsrfToken.class
                        .getName());
                if (csrf != null) {
                    Cookie cookie = WebUtils.getCookie(request, "XSRF-TOKEN");
                    String token = csrf.getToken();
                    if (cookie == null || token != null
                            &amp;&amp; !token.equals(cookie.getValue())) {
                        cookie = new Cookie("XSRF-TOKEN", token);
                        cookie.setPath("/");
                        response.addCookie(cookie);
                    }
                }
                filterChain.doFilter(request, response);
            }
        };
    }

    private CsrfTokenRepository csrfTokenRepository() {
        HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
        repository.setHeaderName("X-XSRF-TOKEN");
        return repository;
    }

}
</code></pre>