I have implemented CSRF Guard into my web application. It's working fine for GET requests (with AJAX and without AJAX) however for POST request token is not getting injected into the request that's why CSRF guard throwing an exception: Token is missing in the request.

My question here is:

  1. CSRF Guard injects token into POST request or not? If YES then what I have to look for to make it work.
  2. Do I have to change my POST requests to make it work with CSRF guard? (Save the token into hidden fields and use it for POST requests.)

Please let me know your points if you know about it. Thanks.

1 Answer 1


Generally, you would indeed creating a hidden field in your forms for the CSRF token when you're POSTing.

From the documentation, it should look something like this:

<input type="hidden" name="<csrf:token-name/>" value="<csrf:token-value/>"/>

Additionally, in order to work for post requests, the inject-into-forms property must be true, like you see in the example:


In fact, disabling this parameter is particularly discouraged, because of the sensitivity of many POST requests.

  • Thanks for your response, however No where mention in the document that it will work for POST requests.
    – SK.
    Dec 20, 2014 at 13:36
  • @Mike It actually does, though it's not terribly clear. I've added some specifics to my answer, and for more detail, search on inject-into-form in the documentation.
    – Xander
    Dec 20, 2014 at 13:56
  • Ya. It's true in both the files web.xml and csrfguard.properties...
    – SK.
    Dec 20, 2014 at 14:23
  • I tried include it in jsp page and got this error No tag "token-name" defined in tag library imported with prefix "csrf"
    – SK.
    Dec 20, 2014 at 14:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .