SPRING CSRF throws 405 despite CSRF token in request
<p>I have a web application that works when I put <code>&lt;security:csrf disabled="true"/&gt;</code> in my security config, but doesn't work when I enable it. I conclude therefore than I'm an idiot, but can't figure out why.</p>

<p>The symptoms are:</p>

<ul>
<li>Throws 405 when deployed in Tomcat with <code>&lt;security:csrf/&gt;</code></li>
<li>Works in Tomcat with <code>&lt;security:csrf disabled="true"/&gt;</code></li>
<li>Works when run under STS's Pivotal server, even with <code>&lt;security:csrf/&gt;</code></li>
</ul>

<p>The precise error is:</p>

<pre><code>"POST /works-1.0-SNAPSHOT/auth/register HTTP/1.1" 405 1088
</code></pre>

<p>Here is my registration form:</p>

<pre><code>&lt;%@ page import="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter" %&gt;
&lt;%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %&gt;
&lt;%@ taglib uri="http://www.springframework.org/tags/form" prefix="form" %&gt;
&lt;%@ taglib uri="http://www.springframework.org/tags" prefix="spring" %&gt;

&lt;%@ page language="java" contentType="text/html; charset=UTF-8"
pageEncoding="UTF-8"%&gt;
&lt;!DOCTYPE html&gt;
&lt;html&gt;
    &lt;head&gt;
        &lt;meta http-equiv="Content-Type" content="text/html; charset=UTF-8"&gt;
        &lt;title&gt;Register&lt;/title&gt;
    &lt;/head&gt;
    &lt;body&gt;

        &lt;h1&gt;Register&lt;/h1&gt;
        &lt;div class="error"&gt;${error}&lt;/div&gt;
        &lt;c:url var="post_url" value="/auth/register"/&gt;
        &lt;form action="${post_url}" method="post" &gt;
      &lt;p&gt;
        &lt;label for="j_username"&gt;Login:&lt;/label&gt;
        &lt;input id="j_username" name="j_username" type="text" value="${j_username}"/&gt;
      &lt;/p&gt;
      &lt;p&gt;
        &lt;label for="j_displayname"&gt;Name:&lt;/label&gt;
        &lt;input id="j_displayname" name="j_displayname" type="text" value="${j_displayname}"/&gt;
      &lt;/p&gt;
      &lt;p&gt;
        &lt;label for="j_password"&gt;Password:&lt;/label&gt;
        &lt;input id="j_password" name="j_password" type="password" /&gt;
      &lt;/p&gt;
       &lt;input type="hidden" name="${_csrf.parameterName}"
                        value="${_csrf.token}" /&gt;
      &lt;input  type="submit" value="Register"/&gt;
    &lt;/form&gt;
    &lt;br/&gt;
    &lt;a href="/auth/login"&gt;Login&lt;/a&gt;
    &lt;/body&gt;
&lt;/html&gt;
</code></pre>

<p>(If you think that this form looks suspiciously like <a href="https://github.com/neo4j-examples/sdn4-cineasts" rel="nofollow">SDN4-cineasts</a>'s one, you're right: my project is derived from that source code.)</p>

<p>As you can see, the CSRF token is in there. When I "show source" on the displayed web page, I can see that the token is indeed present.  Any ideas?</p>

<p>Here is my pom:</p>

<pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns="http://maven.apache.org/POM/4.0.0"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"&gt;
    &lt;modelVersion&gt;4.0.0&lt;/modelVersion&gt;

    &lt;groupId&gt;de.artdecode.works&lt;/groupId&gt;
    &lt;artifactId&gt;works&lt;/artifactId&gt;
    &lt;version&gt;1.0-SNAPSHOT&lt;/version&gt;
    &lt;packaging&gt;war&lt;/packaging&gt;

    &lt;name&gt;Works database&lt;/name&gt;

    &lt;properties&gt;
        &lt;project.build.sourceEncoding&gt;UTF-8&lt;/project.build.sourceEncoding&gt;
        &lt;!-- &lt;spring.version&gt;4.2.4.RELEASE&lt;/spring.version&gt; --&gt;
        &lt;spring.version&gt;4.3.2.RELEASE&lt;/spring.version&gt;
        &lt;spring.commons.version&gt;1.12.0.BUILD-SNAPSHOT&lt;/spring.commons.version&gt;
        &lt;!-- &lt;spring.security.version&gt;4.0.3.RELEASE&lt;/spring.security.version&gt; --&gt;
        &lt;spring.security.version&gt;4.1.3.RELEASE&lt;/spring.security.version&gt;
        &lt;!-- &lt;neo4j.version&gt;2.3.2&lt;/neo4j.version&gt;  --&gt;
        &lt;neo4j.version&gt;3.0.3&lt;/neo4j.version&gt;
        &lt;!-- &lt;sdn.version&gt;4.1.0.M1&lt;/sdn.version&gt; --&gt;
        &lt;sdn.version&gt;4.1.2.RELEASE&lt;/sdn.version&gt;
        &lt;neo4j.ogm.version&gt;2.0.4&lt;/neo4j.ogm.version&gt;
    &lt;/properties&gt;

    &lt;dependencies&gt;
        &lt;!-- J2EE --&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;javax.servlet&lt;/groupId&gt;
            &lt;artifactId&gt;jstl&lt;/artifactId&gt;
            &lt;version&gt;1.2&lt;/version&gt;
        &lt;/dependency&gt;


       &lt;!-- Spring --&gt;

        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework&lt;/groupId&gt;
            &lt;artifactId&gt;spring-core&lt;/artifactId&gt;
            &lt;version&gt;${spring.version}&lt;/version&gt;
            &lt;exclusions&gt;
                &lt;exclusion&gt;
                    &lt;groupId&gt;commons-logging&lt;/groupId&gt;
                    &lt;artifactId&gt;commons-logging&lt;/artifactId&gt;
                &lt;/exclusion&gt;
            &lt;/exclusions&gt;
        &lt;/dependency&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework&lt;/groupId&gt;
            &lt;artifactId&gt;spring-webmvc&lt;/artifactId&gt;
            &lt;version&gt;${spring.version}&lt;/version&gt;
            &lt;exclusions&gt;
                &lt;exclusion&gt;
                    &lt;groupId&gt;commons-logging&lt;/groupId&gt;
                    &lt;artifactId&gt;commons-logging&lt;/artifactId&gt;
                &lt;/exclusion&gt;
            &lt;/exclusions&gt;
        &lt;/dependency&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework&lt;/groupId&gt;
            &lt;artifactId&gt;spring-aspects&lt;/artifactId&gt;
            &lt;version&gt;${spring.version}&lt;/version&gt;
        &lt;/dependency&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
            &lt;artifactId&gt;spring-security-web&lt;/artifactId&gt;
            &lt;version&gt;${spring.security.version}&lt;/version&gt;
        &lt;/dependency&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
            &lt;artifactId&gt;spring-security-config&lt;/artifactId&gt;
            &lt;version&gt;${spring.security.version}&lt;/version&gt;
        &lt;/dependency&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework.data&lt;/groupId&gt;
            &lt;artifactId&gt;spring-data-neo4j&lt;/artifactId&gt;
            &lt;version&gt;${sdn.version}&lt;/version&gt;
        &lt;/dependency&gt;

        &lt;dependency&gt;
            &lt;groupId&gt;opensymphony&lt;/groupId&gt;
            &lt;artifactId&gt;sitemesh&lt;/artifactId&gt;
            &lt;version&gt;2.4.2&lt;/version&gt;
        &lt;/dependency&gt;

        &lt;!-- Neo4j --&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.neo4j.app&lt;/groupId&gt;
            &lt;artifactId&gt;neo4j-server&lt;/artifactId&gt;
            &lt;version&gt;${neo4j.version}&lt;/version&gt;
        &lt;/dependency&gt;
        &lt;!-- 
        &lt;dependency&gt;
          &lt;groupId&gt;org.neo4j&lt;/groupId&gt;
          &lt;artifactId&gt;neo4j-ogm-bolt-driver&lt;/artifactId&gt;
          &lt;version&gt;2.0.4&lt;/version&gt;
        &lt;/dependency&gt;
        --&gt;

        &lt;!-- Tests --&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework&lt;/groupId&gt;
            &lt;artifactId&gt;spring-test&lt;/artifactId&gt;
            &lt;version&gt;${spring.version}&lt;/version&gt;
            &lt;scope&gt;test&lt;/scope&gt;
            &lt;exclusions&gt;
                &lt;exclusion&gt;
                    &lt;groupId&gt;commons-logging&lt;/groupId&gt;
                    &lt;artifactId&gt;commons-logging&lt;/artifactId&gt;
                &lt;/exclusion&gt;
            &lt;/exclusions&gt;
        &lt;/dependency&gt;

        &lt;dependency&gt;
            &lt;groupId&gt;org.neo4j&lt;/groupId&gt;
            &lt;artifactId&gt;neo4j-ogm-test&lt;/artifactId&gt;
            &lt;version&gt;${neo4j.ogm.version}&lt;/version&gt;
            &lt;scope&gt;test&lt;/scope&gt;
        &lt;/dependency&gt;

        &lt;dependency&gt;
            &lt;groupId&gt;org.neo4j.test&lt;/groupId&gt;
            &lt;artifactId&gt;neo4j-harness&lt;/artifactId&gt;
            &lt;version&gt;${neo4j.version}&lt;/version&gt;
            &lt;scope&gt;test&lt;/scope&gt;
        &lt;/dependency&gt;

        &lt;dependency&gt;
            &lt;groupId&gt;junit&lt;/groupId&gt;
            &lt;artifactId&gt;junit&lt;/artifactId&gt;
            &lt;version&gt;4.12&lt;/version&gt;
            &lt;scope&gt;test&lt;/scope&gt;
        &lt;/dependency&gt;

        &lt;dependency&gt;
            &lt;groupId&gt;org.hamcrest&lt;/groupId&gt;
            &lt;artifactId&gt;hamcrest-library&lt;/artifactId&gt;
            &lt;version&gt;1.3&lt;/version&gt;
        &lt;/dependency&gt;

        &lt;dependency&gt;
            &lt;groupId&gt;org.springframework.data&lt;/groupId&gt;
            &lt;artifactId&gt;spring-data-neo4j&lt;/artifactId&gt;
            &lt;version&gt;${sdn.version}&lt;/version&gt;
            &lt;type&gt;test-jar&lt;/type&gt;
        &lt;/dependency&gt;

        &lt;!-- Others --&gt;
        &lt;dependency&gt;
            &lt;groupId&gt;org.apache.httpcomponents&lt;/groupId&gt;
            &lt;artifactId&gt;httpclient&lt;/artifactId&gt;
            &lt;version&gt;4.5.2&lt;/version&gt;
        &lt;/dependency&gt;

        &lt;dependency&gt;
            &lt;groupId&gt;org.apache.commons&lt;/groupId&gt;
            &lt;artifactId&gt;commons-lang3&lt;/artifactId&gt;
            &lt;version&gt;3.4&lt;/version&gt;
        &lt;/dependency&gt;

        &lt;dependency&gt;
            &lt;groupId&gt;org.slf4j&lt;/groupId&gt;
            &lt;artifactId&gt;slf4j-api&lt;/artifactId&gt;
            &lt;version&gt;1.7.21&lt;/version&gt;
        &lt;/dependency&gt;

        &lt;dependency&gt;
            &lt;groupId&gt;ch.qos.logback&lt;/groupId&gt;
            &lt;artifactId&gt;logback-classic&lt;/artifactId&gt;
            &lt;version&gt;1.1.7&lt;/version&gt;
        &lt;/dependency&gt;

    &lt;/dependencies&gt;


    &lt;repositories&gt;
        &lt;repository&gt;
            &lt;id&gt;spring-libs-snapshot&lt;/id&gt;
            &lt;name&gt;Spring&lt;/name&gt;
            &lt;url&gt;http://repo.spring.io/libs-snapshot&lt;/url&gt;
        &lt;/repository&gt;

        &lt;repository&gt;
            &lt;id&gt;spring-snapshots&lt;/id&gt;
            &lt;url&gt;http://repo.spring.io/snapshot&lt;/url&gt;
            &lt;snapshots&gt;&lt;enabled&gt;true&lt;/enabled&gt;&lt;/snapshots&gt;
        &lt;/repository&gt;

        &lt;repository&gt;
            &lt;id&gt;spring-milestones&lt;/id&gt;
            &lt;url&gt;http://repo.spring.io/milestone&lt;/url&gt;
        &lt;/repository&gt;

        &lt;repository&gt;
            &lt;id&gt;neo4j&lt;/id&gt;
            &lt;url&gt;http://m2.neo4j.org/content/repositories/releases&lt;/url&gt;
            &lt;snapshots&gt;
                &lt;enabled&gt;true&lt;/enabled&gt;
            &lt;/snapshots&gt;
        &lt;/repository&gt;

    &lt;/repositories&gt;
    &lt;pluginRepositories&gt;

        &lt;pluginRepository&gt;
            &lt;id&gt;spring-snapshots&lt;/id&gt;
            &lt;url&gt;http://repo.spring.io/snapshot&lt;/url&gt;
        &lt;/pluginRepository&gt;

        &lt;pluginRepository&gt;
            &lt;id&gt;spring-milestones&lt;/id&gt;
            &lt;url&gt;http://repo.spring.io/milestone&lt;/url&gt;
        &lt;/pluginRepository&gt;

&lt;/pluginRepositories&gt;



    &lt;build&gt;
        &lt;plugins&gt;
            &lt;plugin&gt;
                &lt;groupId&gt;org.apache.maven.plugins&lt;/groupId&gt;
                &lt;artifactId&gt;maven-compiler-plugin&lt;/artifactId&gt;
                &lt;version&gt;2.1&lt;/version&gt;
                &lt;configuration&gt;
                    &lt;source&gt;1.8&lt;/source&gt;
                    &lt;target&gt;1.8&lt;/target&gt;
                    &lt;encoding&gt;${project.build.sourceEncoding}&lt;/encoding&gt;
                &lt;/configuration&gt;
            &lt;/plugin&gt;
            &lt;plugin&gt;
                &lt;groupId&gt;org.mortbay.jetty&lt;/groupId&gt;
                &lt;artifactId&gt;jetty-maven-plugin&lt;/artifactId&gt;
                &lt;version&gt;7.6.5.v20120716&lt;/version&gt;
                &lt;configuration&gt;
                    &lt;scanIntervalSeconds&gt;10&lt;/scanIntervalSeconds&gt;
                    &lt;stopKey&gt;foo&lt;/stopKey&gt;
                    &lt;stopPort&gt;9999&lt;/stopPort&gt;
                    &lt;jvmArgs&gt;&lt;/jvmArgs&gt;
                    &lt;systemProperties&gt;
                        &lt;systemProperty&gt;
                            &lt;name&gt;username&lt;/name&gt;
                            &lt;value&gt;neo4j&lt;/value&gt;
                        &lt;/systemProperty&gt;
                        &lt;systemProperty&gt;
                            &lt;name&gt;password&lt;/name&gt;
                            &lt;value&gt;neo&lt;/value&gt;
                        &lt;/systemProperty&gt;
                    &lt;/systemProperties&gt;
                &lt;/configuration&gt;
            &lt;/plugin&gt;
        &lt;/plugins&gt;
    &lt;/build&gt;
&lt;/project&gt;
</code></pre>

<p>Here is my web.xml:</p>

<pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"&gt;

    &lt;context-param&gt;
        &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
        &lt;param-value&gt;
            /WEB-INF/applicationContext-security.xml
            /WEB-INF/applicationContext.xml
        &lt;/param-value&gt;
    &lt;/context-param&gt;

    &lt;listener&gt;
        &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
    &lt;/listener&gt;
    &lt;listener&gt;
    &lt;listener-class&gt;
        org.springframework.web.context.request.RequestContextListener
    &lt;/listener-class&gt;
    &lt;/listener&gt;
    &lt;filter&gt;
        &lt;filter-name&gt;sitemesh&lt;/filter-name&gt;
        &lt;filter-class&gt;
            com.opensymphony.module.sitemesh.filter.PageFilter
        &lt;/filter-class&gt;
    &lt;/filter&gt;

    &lt;filter&gt;
        &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
        &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
    &lt;/filter&gt;

    &lt;filter-mapping&gt;
        &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
        &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
    &lt;/filter-mapping&gt;

    &lt;filter-mapping&gt;
        &lt;filter-name&gt;sitemesh&lt;/filter-name&gt;
        &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
    &lt;/filter-mapping&gt;

    &lt;servlet&gt;
        &lt;servlet-name&gt;dispatcherServlet&lt;/servlet-name&gt;
        &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
        &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
    &lt;/servlet&gt;

    &lt;servlet-mapping&gt;
        &lt;servlet-name&gt;dispatcherServlet&lt;/servlet-name&gt;
        &lt;url-pattern&gt;/&lt;/url-pattern&gt;
    &lt;/servlet-mapping&gt;

    &lt;welcome-file-list&gt;
        &lt;welcome-file&gt;index.jsp&lt;/welcome-file&gt;
    &lt;/welcome-file-list&gt;

    &lt;session-config&gt;
      &lt;session-timeout&gt;60&lt;/session-timeout&gt;
    &lt;/session-config&gt;
&lt;/web-app&gt;
</code></pre>

<p>Here is my security configuration:</p>

<pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:security="http://www.springframework.org/schema/security"
       xsi:schemaLocation="
        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd"&gt;

    &lt;context:annotation-config/&gt;
    &lt;security:global-method-security secured-annotations="enabled"&gt;
    &lt;/security:global-method-security&gt;

    &lt;security:http&gt; &lt;!-- use-expressions="true" --&gt;
        &lt;security:intercept-url pattern="/admin/*" access="hasRole('ROLE_ADMIN')"/&gt;
        &lt;security:intercept-url pattern="/import/*" access="hasRole('ROLE_ADMIN')"/&gt;
        &lt;security:intercept-url pattern="/user/**" access="hasRole('ROLE_USER')"/&gt;
        &lt;security:intercept-url pattern="/auth/login" access="isAnonymous()"/&gt;
        &lt;security:intercept-url pattern="/auth/register" access="isAnonymous()"/&gt;
        &lt;security:intercept-url pattern="/resources/**" access="permitAll"/&gt;
        &lt;security:intercept-url pattern="/images/**" access="permitAll"/&gt;
        &lt;security:intercept-url pattern="/**" access="isAnonymous() || hasRole('ROLE_USER')"/&gt;
        &lt;security:form-login login-page="/auth/login"
            authentication-failure-url="/auth/login?login_error=true"
            default-target-url="/user"
            login-processing-url="/j_spring_security_check"
            username-parameter="username"
            password-parameter="password"/&gt;
        &lt;security:logout logout-success-url="/" invalidate-session="true" logout-url="/j_spring_security_logout"/&gt;
        &lt;security:access-denied-handler error-page="/auth/denied" /&gt;
        &lt;security:csrf/&gt;
    &lt;/security:http&gt;

    &lt;security:authentication-manager&gt;
        &lt;security:authentication-provider user-service-ref="userRepository"&gt;
            &lt;security:password-encoder hash="md5"&gt;
                &lt;security:salt-source system-wide="cewuiqwzie"/&gt;
            &lt;/security:password-encoder&gt;
        &lt;/security:authentication-provider&gt;
    &lt;/security:authentication-manager&gt;

&lt;/beans&gt;
</code></pre>