Custom CSRF filter for Spring Security doesn't ignore my /login
<p>I'm currently coding the security for a REST enterprise web application and when I finally got a custom CSRF filter work, I realised I can't POST anything into my /login because I need the CSRF token (a GET is possible though). The thing is, how can I retrieve for the first time the token so I can add it into the POST form that goes to the login?</p>

<p>I'm using postman as my REST client and the only way I can get the token is first doing a dummy GET so I can retrieve the token and then add it into the POST, but I'm here assuming this could not be like this.</p>

<p>I'm new to web security, csrf and also am not a front end developer, so the problem could lay there. </p>

<p>P.D: My security:</p>

<pre><code>@Override
protected void configure(HttpSecurity http) throws Exception {

    http    
        .addFilterAfter(new CsrfTokenResponseHeaderBindingFilter(), CsrfFilter.class)
        .authorizeRequests()
        .antMatchers("/login").permitAll().anyRequest().authenticated();

    http
        .formLogin().loginPage("/login").permitAll().successHandler(authenticationSuccessHandler)
        .failureHandler(authenticationFailureHandler)
        .and()
        .rememberMe().rememberMeParameter("remember-me").tokenValiditySeconds(2000)
        .and()
        .exceptionHandling().authenticationEntryPoint(authenticationEntryPoint)
        .and()
        .sessionManagement().maximumSessions(1);

}
</code></pre>

<p>Also tried this one, but no good:</p>

<pre><code> @Override
public void configure(WebSecurity webSecurity) throws Exception
{
    webSecurity
        .ignoring().antMatchers("/login").anyRequest();

}
</code></pre>

<p>I'm using this custom filter, credits to the author: <a href="https://github.com/aditzel/spring-security-csrf-filter" rel="nofollow">https://github.com/aditzel/spring-security-csrf-filter</a> </p>

<p>P.D.2: In case I wasn't clear enough, I want to login using a POST without doing the dummy get first. I don't know if is a code problem or a conceptual (security related) problem.</p>