/** CSRF Token Name */
private static final String CSRF_TOKEN_MAP_KEY        = "_csrf";
private static final String CSRF_TOKEN_PARAMETER_NAME = "_csrf";
private static final String CSRF_TOKEN_HEADER_NAME    = "X-CSRF-TOKEN";
 
// FIXME : REPOSITORY and USER_SESSION is example. DO NOT USE
/** @deprecated */
private static final Map<String, String> REPOSITORY = new HashMap<String, String>();
/** @deprecated */
private static final String USER_SESSION = "USER_SESSION";
 
@GetMapping("/csrf")
public ModelAndView getCsrfPage() {
    ModelAndView csrfModel = new ModelAndView("csrf");
 
    // Generate CSRF Token
    String currentUUID = UUID.randomUUID().toString();
    Map<String, String> csrfTokenMap = Map.of(
        "parameterName", CSRF_TOKEN_PARAMETER_NAME, 
        "headerName",    CSRF_TOKEN_HEADER_NAME,
        "token",         currentUUID);
 
    // FIXME : Map CSRF token and user identification data and store it in repository
    REPOSITORY.put(USER_SESSION, currentUUID);
 
    // Allocate csrfToken
    csrfModel.addObject(CSRF_TOKEN_MAP_KEY, csrfTokenMap);
 
    return csrfModel;
}

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf();
    }
}

@PostMapping("/csrf")
@ResponseBody
public String checkCsrfToken(
        @RequestHeader(value=CSRF_TOKEN_HEADER_NAME, required=false)    String csrfTokenInHeader,
        @RequestParam (value=CSRF_TOKEN_PARAMETER_NAME, required=false) String csrfTokenInParameter,
        @RequestParam("value") String value) {
    String result = "Failed";
 
    // Compare csrf tokens(server and client)
    if(!REPOSITORY.get(USER_SESSION).equals(csrfTokenInHeader)
    && !REPOSITORY.get(USER_SESSION).equals(csrfTokenInParameter)) {
        // TODO : Exception logic(Invalid token)
        throw new SecurityException("CSRF Token is Invalid");
    }
 
    // TODO : Business Logic
    result = value;
 
    return result;
}

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
     
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        super.configure(auth);
    }
 
    @Override
    public void configure(WebSecurity web) throws Exception {
        super.configure(web);
    }
 
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .exceptionHandling()
            .accessDeniedPage("/")
            .accessDeniedHandler(new AccessDeniedHandler() {
                @Override
                public void handle(HttpServletRequest request, HttpServletResponse response,
                        AccessDeniedException accessDeniedException) throws IOException, ServletException {
                    if(accessDeniedException instanceof MissingCsrfTokenException) {
                        // handle missing CSRF Token case
                        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
                    } else if(accessDeniedException instanceof InvalidCsrfTokenException) {
                        // handle invalid CSRF Token case
                        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
                    }
                }
            }).and()
        .authorizeRequests()
            .anyRequest().authenticated()
            .and()
        .formLogin().and()
        .httpBasic();
    }
}