Spring Security 4 curl csrf token not found
<p>I know this question has been asked a lot before, and it applies a lot of different ways, and based on the questions I have already asked on the Internet and here, I have more questions than I have answers.</p>

<p>So, I have a Spring MVC 4.0 RESTful web-service which I know works ok.  I know it works ok because it passes my unit tests.  The unit test, with added security, and "csrf()" as part of the test security makes it work.  I do notice this piece of data added:</p>

<pre><code>Parameters = {_csrf=[435f9968-f643-47e9-9d15-23a5cb361b1d]}
</code></pre>

<p>The RESTful web-service is secured with Spring Security 4, and csrf protection enabled by default.  All web-services with GET work great, it's the POST that is hampering me with that 403 error.</p>

<p>Here is the curl I am trying to implement:</p>

<pre><code>curl \
-d '{"SiteId\:"548","SubjectId":TEST_sub","description":"TEST_des"}' \
--cookie "csrftoken=?????????????" \
--cookie "JSESSIONID=openam~A7FF59011F982FBB91C2F908E143327D" \
--cookie  "iPlanetDirectoryPro=AQIC5wM2LY4Sfcy_7ZIwOhUsE4KK922nQEue1Bgm7wAtX_k.*AAJTSQACMDE.*; path=/; domain=.mydomain.net" \
-H "X-CSFRToken: ??????" -H "Accept: */*" -H "Content-Type: */*" \
-H "openam-token: AQIC5wM2LY4Sfcy_7ZIwOhUsE4KK922nQEue1Bgm7wAtX_k.*AAJTSQACMDE.*" \
https://spring.mydomain.net/api/subject/build
</code></pre>

<p>So, I know the -d parameter explicitly does a POST;
I know the --cookie for iPlanetDirectoryPro is needed for my app
I know the -H for Accept, Content-Type, and openam_token are all needed.</p>

<p>What I am confused about is: 
the -cookie for the csfr token ... where am I getting that data from?
the -cookie for the session id or JSESSIONID?
When I login into my web-site for the first time, I have a cookie like:</p>

<pre><code>JSESSIONID=openam~A7FF59011F982FBB91C2F908E143327D; path=/sso/; domain=spring-auth.mydomain.net; Secure; HttpOnly
</code></pre>

<p>Now when it comes to the header:
is it X-CSFR-TOKEN or X-CSFRToken ... I've seen both.</p>

<p>I have a SimpleCORSFilter, but this header is not one of the ones allowed, does it need to be?  I can add it in to the list of acceptable headers.</p>

<p>I am concerned about putting the _csfr into the JSON data.  Using the Jackson mapper if I added it, I am afraid the web-service wouldn't work because _csrf doesn't have a matching object, so I'd just presume keeping it out of there if I did.  </p>

<p>So, I've done a lot of trial and error from curl, and I am not having much luck today with this.  When I do get the curl to work, then I have to pass this over to the contractor working on the UI.  They are using JavaScript to create AJX calls to the back-end and so they can pass whatever they need back in the URL, post data back, and they can add whatever headers or cookies they need to pass data back.   I leave that for them to figure out.</p>

<p>Any help in getting my curl to work would be great.    Thanks!</p>

<p>UPDATE:
When a user logs into my app, we use a derivative of the SiteMinder example.
That is we get a cookie from OpenAM when we successfully authenticate.  Then we use the siteminder example to call a CustomUserDetailsService which uses that cookie to call OpenAM and get the username.  Then we do a database lookup on that username to get the roles for that user.  In none of this, do we get back any type of csrf token.  So, for all the examples I've seen on StackOverflow, there is NO csrf token for me to pass back.  With that I added the following RESTful web-service.</p>

<pre><code>@RequestMapping(value = "/csrf-token", method = RequestMethod.GET)
public @ResponseBody String getCsrfToken(HttpServletRequest request)
{
    CsrfToken token = (CsrfToken) request.getAttribute(CsrfToken.class.getName());
    return token.getToken();
}
</code></pre>

<p>I can successfully call this URL at any time and get a token return back to the client.  For Example:  "45757c25-1af7-40d3-ab8b-1a9cd823efc5"</p>

<p>So, I am testing this out in two places:  RESTClient for Firefox and curl ...</p>

<p>in RESTClient, I can make a request and get a csrf token, then I am trying to put it into RESTClient as follows:</p>

<pre><code>URL: https://spring.mydomain.net/api/subject/build?_csrf=[45757c25-1af7-40d3-ab8b-1a9cd823efc5]
Headers:  
openam_token: AQIC5wM2LY4SfczkVMBTIq4pyjcec7QkyN0PJbY3NdmF8WE.*AAJTSQACMDE.*
X-CSRF-TOKEN: [45757c25-1af7-40d3-ab8b-1a9cd823efc5]
</code></pre>

<p>Is there anything more that I need because it is not working yet.</p>

<p>And in curl:</p>

<pre><code>curl \
-d '{"SiteId\:"548","SubjectId":TEST_sub","description":"TEST_des"}' \
--cookie "csrftoken=45757c25-1af7-40d3-ab8b-1a9cd823efc5" \
--cookie "JSESSIONID=openam~A7FF59011F982FBB91C2F908E143327D" \
--cookie  "iPlanetDirectoryPro=AQIC5wM2LY4Sfcy_7ZIwOhUsE4KK922nQEue1Bgm7wAtX_k.*AAJTSQACMDE.*; path=/; domain=.mydomain.net" \
-H "X-CSFR-TOKEN: 45757c25-1af7-40d3-ab8b-1a9cd823efc5" 
-H "Accept: */*" -H "Content-Type: */*" \
-H "openam-token: AQIC5wM2LY4Sfcy_7ZIwOhUsE4KK922nQEue1Bgm7wAtX_k.*AAJTSQACMDE.*" \
https://spring.mydomain.net/api/subject/build
</code></pre>

<p>Again, what am I missing to make this work????</p>

<p>Do I have to somehow combine my call in RESTClient to get this token, AND then to my POST?   How do I combine these in curl?   I know there is one csrf token per session, I want to know I can make one call and get this token, and then use it in the very next request to pass back for a POST.</p>

<p>I'm not doing the front-end, we have another company that is working on the UI and the Ajax calls, I want to be able to test my web-service call before I pass it along to them.</p>

<p>Thanks again!</p>