how could I use csrf in spring security
<p>My login page.</p>

<pre><code>&lt;form class="form-horizontal" ng-controller="loginCtrl" action="/login" method="post"&gt;
    &lt;div class="form-group input-login"&gt;
        &lt;div ng-if="message.error" class="alert alert-danger"&gt;
            &lt;p&gt;Invalid username and password.&lt;/p&gt;
        &lt;/div&gt;
        &lt;div ng-if="message.logout" class="alert alert-success"&gt;
            &lt;p&gt;You have been logged out successfully.&lt;/p&gt;
        &lt;/div&gt;
        &lt;label  class="control-label sr-only"&gt;Email&lt;/label&gt;
        &lt;div class="col-md-12"&gt;
            &lt;input type="text" class="form-control" ng-model="user.username" name="username" placeholder="NickName"/&gt;
        &lt;/div&gt;
    &lt;/div&gt;
    &lt;div class="form-group input-login"&gt;
        &lt;label  class="control-label sr-only"&gt;Password&lt;/label&gt;
        &lt;div class="col-md-12"&gt;
            &lt;input type="password" class="form-control" ng-model="user.password" name="password" placeholder="Password"/&gt;
        &lt;/div&gt;
    &lt;/div&gt;
    &lt;input name="_csrf" type="hidden" value="6829b1ae-0a14-4920-aac4-5abbd7eeb9ee" /&gt; 
    &lt;div class="form-group sub-login"&gt;
        &lt;div class=" col-md-12"&gt;
            &lt;button name="submit" type="submit" class="btn btn-primary btn-login"&gt;Login&lt;/button&gt;
        &lt;/div&gt;
    &lt;/div&gt;
&lt;/form&gt;
</code></pre>

<p>But if I didn't disable the <code>csrf</code>,it alway be <code>accessDenied</code>.I don't know where is the problem.</p>

<p>My config code below.</p>

<pre><code>@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDao userDao;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        auth.userDetailsService(new UserService(userDao)).passwordEncoder(new MD5Util());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests()
                .antMatchers("/", "/index").access("hasRole('USER')")
                .and()
                    .formLogin()
                    .loginPage("/login")
                    .failureUrl("/login#/signin?error=1")
                    .successHandler(new LoginSuccessHandler())
                    .usernameParameter("username").passwordParameter("password")
                .and()
                    .logout()
                    .logoutUrl("/logout")
                    .logoutSuccessUrl("/login#/signin?logout=1")
                .and()
                    .exceptionHandling().accessDeniedPage("/Access_Denied")
                .and().csrf().disable(); // If I  disable this csrf,it worked!

    }
}
</code></pre>

<p>And does anyone knows how to ues <code>thymeleaf</code> in <code>ng-route</code>'s partial page.Just see this <a href="https://stackoverflow.com/questions/36734466/thymeleaf-tag-did-not-work-in-ng-route">question</a>.</p>