OWASP CSRFGuard 3.1.0表单隐藏字段OWASP_CSRFTOKEN的值为空

Question

我正在尝试将CS​​RFGuard 3.1.0集成到我现有的spring mvc应用程序中。

我的web.xml如下。

<!-- Spring MVC stuff below here -->
    <servlet>
        <servlet-name>spring</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>2</load-on-startup>
    </servlet>

    <servlet-mapping>
        <servlet-name>spring</servlet-name>
        <url-pattern>*.htm</url-pattern>
    </servlet-mapping>

    <servlet-mapping>
        <servlet-name>spring</servlet-name>
        <url-pattern>*.json</url-pattern>
    </servlet-mapping>


    <listener>
        <listener-class>org.owasp.csrfguard.CsrfGuardServletContextListener</listener-class>
    </listener>
    <listener>
        <listener-class>org.owasp.csrfguard.CsrfGuardHttpSessionListener</listener-class>
    </listener>

    <context-param>
             <param-name>Owasp.CsrfGuard.Config</param-name>
             <param-value>/WEB-INF/classes/Owasp.CsrfGuard.properties</param-value>
       </context-param>
       <context-param>
             <param-name>Owasp.CsrfGuard.Config.Print</param-name>
             <param-value>true</param-value>
       </context-param>

    <filter>
        <filter-name>CSRFGuard</filter-name>
        <filter-class>org.owasp.csrfguard.CsrfGuardFilter</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>CSRFGuard</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <servlet>
        <servlet-name>JavaScriptServlet</servlet-name>
        <servlet-class>org.owasp.csrfguard.servlet.JavaScriptServlet</servlet-class>
    </servlet>

    <servlet-mapping>
        <servlet-name>JavaScriptServlet</servlet-name>
        <url-pattern>/JavaScriptServlet</url-pattern>
    </servlet-mapping>

在jsp页面中添加了必需的标记库和javascript标头。

<script src="/JavaScriptServlet"></script>
<%@ taglib uri="http://www.owasp.org/index.php/Category:OWASP_CSRFGuard_Project/Owasp.CsrfGuard.tld" prefix="csrf" %>

  

我用csrf标签创建了表单。

以及相关的属性文件也已就绪。

但是当tomcat启动并转到jsp页面时，OWASP_CSRFTOKEN的隐藏字段值为空。

我一直到处闲逛，为什么它会为null。但是仍然没有运气