Question: how csrf token is generated in spring?
Answer: In Spring Security, the CSRF tokens are generated per session. When a session starts, a CSRF token is generated. If the session changes or times out, a new CSRF token will be returned by the server. ... A session is already granted to the client, and a CSRF token is sent back in the response.