Could not verify the provided CSRF token because your session was not found.</error_description><error>access_denied</error></oauth>*
<p>I am developing <strong>Spring MVC + Spring Security OAuth2</strong> example.</p>

<p>In this example I was using the </p>

<ul>
<li>Spring Security version
<code>&lt;springsec.version&gt;3.2.8.RELEASE&lt;/springsec.version&gt;</code> </li>
<li>Spring MVC version <code>&lt;spring.version&gt;4.0.9.RELEASE&lt;/spring.version&gt;</code></li>
</ul>

<p>But my business client wants to update Spring and Security dependencies to their latest versions. I changed</p>

<ul>
<li><p>Spring MVC to <code>&lt;spring.version&gt;4.3.1.RELEASE&lt;/spring.version&gt;</code> and </p></li>
<li><p>Security to <code>&lt;springsec.version&gt;4.1.1.RELEASE&lt;/springsec.version&gt;</code>.</p></li>
</ul>

<p>I was able to successfully deploy the application, however when I tried to get an access token using below CURL command I got the following error. Why ?</p>

<pre><code>C:\&gt;curl -vvv -X POST "http://localhost:8080/demo.rest.springsecurity.oauth2.0.authentication/oauth/token?username=user1&amp;password=user1&amp;client_id=client1&amp;client_secret=client1&amp;grant_type=password&amp;scope=read,write,trust"
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 8080 (#0)
&gt; POST /demo.rest.springsecurity.oauth2.0.authentication/oauth/token?username=user1&amp;password=user1&amp;client_id=client1&amp;client_secret=client1&amp;grant_type=password&amp;scope=read,write,trust HTTP/1.1
&gt; Host: localhost:8080
&gt; User-Agent: curl/7.46.0
&gt; Accept: */*
&gt;
&lt; HTTP/1.1 403 Forbidden
&lt; Server: Apache-Coyote/1.1
&lt; Set-Cookie: JSESSIONID=D3BE17423B26618D2931A9B317E422E1; Path=/demo.rest.springsecurity.oauth2.0.authentication/; HttpOnly
&lt; Cache-Control: no-store
&lt; Pragma: no-cache
&lt; X-XSS-Protection: 1; mode=block
&lt; X-Frame-Options: DENY
&lt; X-Content-Type-Options: nosniff
&lt; Content-Type: application/xml
&lt; Transfer-Encoding: chunked
&lt; Date: Wed, 17 Aug 2016 11:19:28 GMT
&lt;
&lt;oauth&gt;&lt;error_description&gt;Could not verify the provided CSRF token because your session was not found.&lt;/error_description&gt;&lt;error&gt;access_denied&lt;/error&gt;&lt;/oauth&gt;* Connection #0 to host localhost left intact

C:\&gt;
</code></pre>

<p>My <strong>pom.xml</strong> for reference:</p>

<pre><code>&lt;properties&gt;
        &lt;!-- General Properties --&gt;
        &lt;java.version&gt;1.8&lt;/java.version&gt;
        &lt;project.build.sourceEncoding&gt;UTF-8&lt;/project.build.sourceEncoding&gt;
        &lt;project.reporting.outputEncoding&gt;UTF-8&lt;/project.reporting.outputEncoding&gt;

        &lt;!-- Spring Security --&gt;
        &lt;!-- &lt;springsec.version&gt;3.2.8.RELEASE&lt;/springsec.version&gt; --&gt;
        &lt;springsec.version&gt;4.1.1.RELEASE&lt;/springsec.version&gt;

        &lt;!-- Spring MVC --&gt;
        &lt;!-- &lt;spring.version&gt;4.0.9.RELEASE&lt;/spring.version&gt; --&gt;
        &lt;spring.version&gt;4.3.1.RELEASE&lt;/spring.version&gt;

        &lt;!-- Jersey Server --&gt;
        &lt;jersey-version&gt;1.19&lt;/jersey-version&gt;

        &lt;!-- Spring Security OAuth2 --&gt;
        &lt;spring-security-oauth2-version&gt;2.0.10.RELEASE&lt;/spring-security-oauth2-version&gt;

        &lt;logback.version&gt;1.1.7&lt;/logback.version&gt;
        &lt;jcl-over-slf4j.version&gt;1.7.21&lt;/jcl-over-slf4j.version&gt;

        &lt;!-- Servlet, JSP, CGLIB, JSTL --&gt;
        &lt;servlet.version&gt;3.1.0&lt;/servlet.version&gt;
        &lt;jsp.version&gt;2.2&lt;/jsp.version&gt;
        &lt;cglib.version&gt;2.2.2&lt;/cglib.version&gt;
        &lt;jstl.version&gt;1.2&lt;/jstl.version&gt;
    &lt;/properties&gt;


    &lt;dependencies&gt;
        &lt;!-- Spring Security OAuth2 --&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework.security.oauth&lt;/groupId&gt;
            &lt;artifactId&gt;spring-security-oauth2&lt;/artifactId&gt;
            &lt;version&gt;${spring-security-oauth2-version}&lt;/version&gt;
        &lt;/dependency&gt;

        &lt;!-- Spring Web MVC --&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework&lt;/groupId&gt;
            &lt;artifactId&gt;spring-webmvc&lt;/artifactId&gt;
            &lt;version&gt;${spring.version}&lt;/version&gt;
        &lt;/dependency&gt;

        &lt;!-- Spring security core, web, config, aspects, taglibs --&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
            &lt;artifactId&gt;spring-security-web&lt;/artifactId&gt;
            &lt;version&gt;${springsec.version}&lt;/version&gt;
        &lt;/dependency&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
            &lt;artifactId&gt;spring-security-config&lt;/artifactId&gt;
            &lt;version&gt;${springsec.version}&lt;/version&gt;
        &lt;/dependency&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
            &lt;artifactId&gt;spring-security-aspects&lt;/artifactId&gt;
            &lt;version&gt;${springsec.version}&lt;/version&gt;
        &lt;/dependency&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
            &lt;artifactId&gt;spring-security-taglibs&lt;/artifactId&gt;
            &lt;version&gt;${springsec.version}&lt;/version&gt;
        &lt;/dependency&gt;

        &lt;!-- JSTL --&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;javax.servlet&lt;/groupId&gt;
            &lt;artifactId&gt;jstl&lt;/artifactId&gt;
            &lt;version&gt;${jstl.version}&lt;/version&gt;
        &lt;/dependency&gt;

        &lt;!-- Jersey Server --&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;com.sun.jersey&lt;/groupId&gt;
            &lt;artifactId&gt;jersey-server&lt;/artifactId&gt;
            &lt;version&gt;${jersey-version}&lt;/version&gt;
        &lt;/dependency&gt;
        &lt;!-- Jersey Client --&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;com.sun.jersey.contribs&lt;/groupId&gt;
            &lt;artifactId&gt;jersey-apache-client&lt;/artifactId&gt;
            &lt;version&gt;${jersey-version}&lt;/version&gt;
        &lt;/dependency&gt;
        &lt;!-- Spring Jersey --&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;com.sun.jersey.contribs&lt;/groupId&gt;
            &lt;artifactId&gt;jersey-spring&lt;/artifactId&gt;
            &lt;version&gt;${jersey-version}&lt;/version&gt;
            &lt;exclusions&gt;
                &lt;exclusion&gt;
                    &lt;groupId&gt;org.springframework&lt;/groupId&gt;
                    &lt;artifactId&gt;spring-core&lt;/artifactId&gt;
                &lt;/exclusion&gt;
                &lt;exclusion&gt;
                    &lt;groupId&gt;org.springframework&lt;/groupId&gt;
                    &lt;artifactId&gt;spring-beans&lt;/artifactId&gt;
                &lt;/exclusion&gt;
                &lt;exclusion&gt;
                    &lt;groupId&gt;org.springframework&lt;/groupId&gt;
                    &lt;artifactId&gt;spring-context&lt;/artifactId&gt;
                &lt;/exclusion&gt;
                &lt;exclusion&gt;
                    &lt;groupId&gt;org.springframework&lt;/groupId&gt;
                    &lt;artifactId&gt;spring-web&lt;/artifactId&gt;
                &lt;/exclusion&gt;
                &lt;exclusion&gt;
                    &lt;groupId&gt;org.springframework&lt;/groupId&gt;
                    &lt;artifactId&gt;spring-aop&lt;/artifactId&gt;
                &lt;/exclusion&gt;
            &lt;/exclusions&gt;
        &lt;/dependency&gt;
        &lt;!-- Jersey JSON --&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;com.sun.jersey&lt;/groupId&gt;
            &lt;artifactId&gt;jersey-json&lt;/artifactId&gt;
            &lt;version&gt;${jersey-version}&lt;/version&gt;
        &lt;/dependency&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;com.sun.jersey&lt;/groupId&gt;
            &lt;artifactId&gt;jersey-client&lt;/artifactId&gt;
            &lt;version&gt;${jersey-version}&lt;/version&gt;
        &lt;/dependency&gt;

        &lt;!-- Spring Core, Context, Support, beans, test, Web MVC --&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework&lt;/groupId&gt;
            &lt;artifactId&gt;spring-core&lt;/artifactId&gt;
            &lt;version&gt;${spring.version}&lt;/version&gt;
        &lt;/dependency&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework&lt;/groupId&gt;
            &lt;artifactId&gt;spring-context&lt;/artifactId&gt;
            &lt;version&gt;${spring.version}&lt;/version&gt;
        &lt;/dependency&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework&lt;/groupId&gt;
            &lt;artifactId&gt;spring-context-support&lt;/artifactId&gt;
            &lt;version&gt;${spring.version}&lt;/version&gt;
        &lt;/dependency&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework&lt;/groupId&gt;
            &lt;artifactId&gt;spring-beans&lt;/artifactId&gt;
            &lt;version&gt;${spring.version}&lt;/version&gt;
        &lt;/dependency&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework&lt;/groupId&gt;
            &lt;artifactId&gt;spring-test&lt;/artifactId&gt;
            &lt;version&gt;${spring.version}&lt;/version&gt;
            &lt;scope&gt;test&lt;/scope&gt;
        &lt;/dependency&gt;


        &lt;!-- logging, slf4j --&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.slf4j&lt;/groupId&gt;
            &lt;artifactId&gt;jcl-over-slf4j&lt;/artifactId&gt;
            &lt;version&gt;${jcl-over-slf4j.version}&lt;/version&gt;
        &lt;/dependency&gt;

        &lt;dependency&gt;
            &lt;groupId&gt;ch.qos.logback&lt;/groupId&gt;
            &lt;artifactId&gt;logback-classic&lt;/artifactId&gt;
            &lt;version&gt;${logback.version}&lt;/version&gt;
        &lt;/dependency&gt;

        &lt;!-- Cglib --&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;cglib&lt;/groupId&gt;
            &lt;artifactId&gt;cglib&lt;/artifactId&gt;
            &lt;version&gt;${cglib.version}&lt;/version&gt;
        &lt;/dependency&gt;
        &lt;!-- Servlet --&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;javax.servlet&lt;/groupId&gt;
            &lt;artifactId&gt;javax.servlet-api&lt;/artifactId&gt;
            &lt;version&gt;${servlet.version}&lt;/version&gt;
        &lt;/dependency&gt;
        &lt;!-- JSP API --&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;javax.servlet.jsp&lt;/groupId&gt;
            &lt;artifactId&gt;jsp-api&lt;/artifactId&gt;
            &lt;version&gt;${jsp.version}&lt;/version&gt;
            &lt;scope&gt;provided&lt;/scope&gt;
        &lt;/dependency&gt;
</code></pre>

<p><strong>spring-servlet.xml</strong></p>

<pre><code>&lt;?xml version="1.0" encoding="UTF-8" ?&gt;
&lt;beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
    xmlns:sec="http://www.springframework.org/schema/security" xmlns:mvc="http://www.springframework.org/schema/mvc"
    xsi:schemaLocation="http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2.xsd
        http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd
        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd "&gt;


    &lt;http pattern="/oauth/token" create-session="stateless"  authentication-manager-ref="authenticationManager"
        xmlns="http://www.springframework.org/schema/security" &gt; 

        &lt;intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" /&gt;
        &lt;anonymous enabled="false" /&gt;
        &lt;http-basic entry-point-ref="clientAuthenticationEntryPoint" /&gt;
        &lt;custom-filter ref="clientCredentialsTokenEndpointFilter" before="BASIC_AUTH_FILTER" /&gt; 
        &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
    &lt;/http&gt;

    &lt;http pattern="/resources/**" create-session="never" entry-point-ref="oauthAuthenticationEntryPoint"
        xmlns="http://www.springframework.org/schema/security"&gt;
        &lt;anonymous enabled="false" /&gt;
        &lt;intercept-url pattern="/resources/**" method="GET" /&gt;
        &lt;!-- &lt;intercept-url pattern="/resources/**" access="IS_AUTHENTICATED_FULLY" /&gt; --&gt;
        &lt;custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /&gt;
        &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
    &lt;/http&gt;

    &lt;http pattern="/logout" create-session="never" 
        entry-point-ref="oauthAuthenticationEntryPoint"
        xmlns="http://www.springframework.org/schema/security"&gt;
        &lt;anonymous enabled="false" /&gt;
        &lt;intercept-url pattern="/logout" method="GET" /&gt;
        &lt;sec:logout invalidate-session="true" logout-url="/logout" success-handler-ref="logoutSuccessHandler"   /&gt;
        &lt;custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /&gt;
        &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
    &lt;/http&gt;

    &lt;bean id="logoutSuccessHandler" class="demo.oauth2.authentication.security.LogoutImpl" &gt;
        &lt;property name="tokenstore" ref="tokenStore"&gt;&lt;/property&gt;
    &lt;/bean&gt;

    &lt;bean id="oauthAuthenticationEntryPoint"
        class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
    &lt;/bean&gt;

    &lt;bean id="clientAuthenticationEntryPoint"
        class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
        &lt;property name="realmName" value="springsec/client" /&gt;
        &lt;property name="typeName" value="Basic" /&gt;
    &lt;/bean&gt;

    &lt;bean id="oauthAccessDeniedHandler"
        class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler"&gt;
    &lt;/bean&gt;

    &lt;bean id="clientCredentialsTokenEndpointFilter"
        class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"&gt;
        &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
    &lt;/bean&gt;

    &lt;authentication-manager alias="authenticationManager"
        xmlns="http://www.springframework.org/schema/security"&gt;
        &lt;authentication-provider user-service-ref="clientDetailsUserService" /&gt;
    &lt;/authentication-manager&gt;

    &lt;bean id="clientDetailsUserService"
        class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"&gt;
        &lt;constructor-arg ref="clientDetails" /&gt;
    &lt;/bean&gt;

    &lt;bean id="clientDetails" class="demo.oauth2.authentication.security.ClientDetailsServiceImpl"/&gt;

    &lt;authentication-manager id="userAuthenticationManager" 
        xmlns="http://www.springframework.org/schema/security"&gt;
        &lt;authentication-provider  ref="customUserAuthenticationProvider"&gt;
        &lt;/authentication-provider&gt;
    &lt;/authentication-manager&gt;

    &lt;bean id="customUserAuthenticationProvider"
        class="demo.oauth2.authentication.security.CustomUserAuthenticationProvider"&gt;
    &lt;/bean&gt;

    &lt;oauth:authorization-server
        client-details-service-ref="clientDetails" token-services-ref="tokenServices"&gt;
        &lt;oauth:authorization-code /&gt;
        &lt;oauth:implicit/&gt;
        &lt;oauth:refresh-token/&gt;
        &lt;oauth:client-credentials /&gt;
        &lt;oauth:password authentication-manager-ref="userAuthenticationManager"/&gt;
    &lt;/oauth:authorization-server&gt;

    &lt;oauth:resource-server id="resourceServerFilter"
        resource-id="springsec" token-services-ref="tokenServices" /&gt;

    &lt;!-- &lt;bean id="tokenStore"
        class="org.springframework.security.oauth2.provider.token.InMemoryTokenStore" /&gt; --&gt;

    &lt;bean id="tokenStore"
          class="org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore" /&gt;

    &lt;bean id="tokenServices" 
        class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
        &lt;property name="tokenStore" ref="tokenStore" /&gt;
        &lt;property name="supportRefreshToken" value="true" /&gt;
        &lt;property name="accessTokenValiditySeconds" value="300000"&gt;&lt;/property&gt;
        &lt;property name="clientDetailsService" ref="clientDetails" /&gt;
    &lt;/bean&gt;


    &lt;mvc:annotation-driven /&gt;   &lt;!-- Declares explicit support for annotation-driven MVC controllers  @RequestMapping, @Controller --&gt;

    &lt;mvc:default-servlet-handler /&gt;

    &lt;bean id="MyResource" class="demo.oauth2.authentication.resources.MyResource"&gt;&lt;/bean&gt;

&lt;/beans&gt;
</code></pre>