java - Renaming Spring csrf token variable -

my application runs under portal application. both implemented in spring , both use csrf security.

my need change how csrf token named in session, both tokens can work without conflicts. tried far creating token repository , trying change parameter name , session attribute name in security config class.

final httpsessioncsrftokenrepository tokenrepository = new httpsessioncsrftokenrepository(); tokenrepository.setheadername("toolbiz-csrf-token"); tokenrepository.setparametername("toolbiz_csfr"); //tokenrepository.setsessionattributename("toolbiz_csrf"); 

when make request spring doesn't new setup much, , log produces following line:

invalid csrf token found 

what should more? missing something?

this worked me:-

@configuration @order(securityproperties.access_override_order) public class optosoftwebfrontsecurity extends websecurityconfigureradapter {  @override protected void configure(httpsecurity http) throws exception {     http.authorizerequests().antmatchers("/assets/**").permitall()             .anyrequest().authenticated().and().formlogin().and()             .httpbasic().disable()             .addfilterafter(new csrfheaderfilter(), csrffilter.class)             .csrf().csrftokenrepository(csrftokenrepository()); }  private csrftokenrepository csrftokenrepository() {     httpsessioncsrftokenrepository repository = new httpsessioncsrftokenrepository();     repository.setheadername("x-xsrf-token");     repository.setparametername("_csrf");     return repository; }  } 

and filter:-

public class csrfheaderfilter extends onceperrequestfilter {     @override     protected void dofilterinternal(httpservletrequest request,             httpservletresponse response, filterchain filterchain)             throws servletexception, ioexception {         csrftoken csrf = (csrftoken) request.getattribute(csrftoken.class                 .getname());         if (csrf != null) {             cookie cookie = webutils.getcookie(request, "xsrf-token");             string token = csrf.gettoken();             if (cookie == null || token != null                     && !token.equals(cookie.getvalue())) {                 cookie = new cookie("xsrf-token", token);                 cookie.setpath("/");                 response.addcookie(cookie);             }         }         filterchain.dofilter(request, response);     } } 

did override websecurityconfigureradapter#configure method?