Default CsrfTokenRequestProcessor.csrfRequestAttributeName = _csrf

Issue gh-11764
Issue gh-4001

web/src/main/java/org/springframework/security/web/csrf/CsrfTokenRequestAttributeHandler.java

@@ -18,8 +18,8 @@ package org.springframework.security.web.csrf;
 
 import java.util.function.Supplier;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 /**
  * A callback interface that is used to make the {@link CsrfToken} created by the

web/src/main/java/org/springframework/security/web/csrf/CsrfTokenRequestProcessor.java

@@ -18,8 +18,8 @@ package org.springframework.security.web.csrf;
 
 import java.util.function.Supplier;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import org.springframework.util.Assert;
 
@@ -34,7 +34,7 @@ import org.springframework.util.Assert;
  */
 public class CsrfTokenRequestProcessor implements CsrfTokenRequestAttributeHandler, CsrfTokenRequestResolver {
 
-	private String csrfRequestAttributeName;
+	private String csrfRequestAttributeName = "_csrf";
 
 	/**
 	 * The {@link CsrfToken} is available as a request attribute named

web/src/main/java/org/springframework/security/web/csrf/CsrfTokenRequestResolver.java

@@ -16,7 +16,7 @@
 
 package org.springframework.security.web.csrf;
 
-import javax.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequest;
 
 /**
  * Implementations of this interface are capable of resolving the token value of a

web/src/test/java/org/springframework/security/web/csrf/CsrfTokenRequestProcessorTests.java

@@ -78,17 +78,17 @@ public class CsrfTokenRequestProcessorTests {
 
 	@Test
 	public void handleWhenCsrfRequestAttributeSetThenUsed() {
-		this.processor.setCsrfRequestAttributeName("_csrf");
+		this.processor.setCsrfRequestAttributeName("_csrf.attr");
 		this.processor.handle(this.request, this.response, () -> this.token);
 		assertThat(this.request.getAttribute(CsrfToken.class.getName())).isEqualTo(this.token);
-		assertThat(this.request.getAttribute("_csrf")).isEqualTo(this.token);
+		assertThat(this.request.getAttribute("_csrf.attr")).isEqualTo(this.token);
 	}
 
 	@Test
 	public void handleWhenValidParametersThenRequestAttributesSet() {
 		this.processor.handle(this.request, this.response, () -> this.token);
 		assertThat(this.request.getAttribute(CsrfToken.class.getName())).isEqualTo(this.token);
-		assertThat(this.request.getAttribute(this.token.getParameterName())).isEqualTo(this.token);
+		assertThat(this.request.getAttribute("_csrf")).isEqualTo(this.token);
 	}
 
 	@Test