java - Invoking ${_csrf.parameterName} & ${_csrf.token} in the logout form through url click instead -

hello i'm learning security through spring, read sentence tutorial if csrf enabled, have include _csrf.token in page want login or logout.

here's how invoke them through submit button :

    <c:url var="logoutaction" value="/j_spring_security_logout" />                         <form action="${logoutaction}" method="post">         <input type="submit" value="logout" />         <input type="hidden" name="${_csrf.parametername}" value="${_csrf.token}" />         </form> 

my question how if they're got invoked in form of <a href=".."> :

<c:url var="logoutaction" value="/j_spring_security_logout" />     <a href="${logoutaction}"> logout</a>  

how invoke csrf protection in above form, hope question thank you.

you configured incorrectly, should first include spring tag library using jsp directive this:

<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %> 

then within form make sure included:

<sec:csrfinput /> 

for example:

<form method="post" action="/do/something">         <sec:csrfinput />         name:<br />         <input type="text" name="name" />         ... </form> 

do same logout link, use form. here's example project:

<form id="logoutform" method="post" action='<c:url value="/logout"/>'>     <sec:csrfinput/> </form>