스프링을 공부하면서 https://cloudstudying.kr/lectures/126 를 참고하여 로그인 기능을 구현했습니다. 1.로그인 후 수정이나 등록을 하면 **요청 매개 변수 '_csrf'또는 헤더 'X-CSRF-TOKEN'에서 유효하지 않은 CSRF 토큰 'null'** 에러가 뜹니다. 그래서 security-context.xml에 <sec:http pattern="/movies/**" security="none" /> 이 부분을 추가했더니 잘 되던데 이부분을 추가안하면 에러가 뜨는 이유는 뭔가요? 2.제가 코드를 구현한 결과는 아래의 사진처럼 로그인을 하고 INDEX.JSP에서 **권한:[ROLE_USER]** 부분과 **로그아웃 버튼**이 보이지않습니다. ![enter image description here][1] [1]: http://i.imgur.com/4BZvKgF.png -코드 첨부합니다. 아무리 찾아도 모르겠습니다ㅠ도와주세요 **-security-context.xml** <?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="http://www.springframework.org/schema/security" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd"> <!-- 스프링 시큐리티 설정의 거의 모든 것 --> <sec:http pattern="/css/**" security="none" /> <sec:http pattern="/img/**" security="none" /> <sec:http pattern="/js/**" security="none" /> <sec:http pattern="/movies/**" security="none" /><!-- 수정과 등록이 안돼서 추가함 --> <sec:http pattern="/uploads/**" security="none" /> <sec:http auto-config='true' use-expressions="true"> <sec:intercept-url pattern="/" access="permitAll" /> <sec:intercept-url pattern="/login" access="permitAll" /> <sec:intercept-url pattern="/**" access="isAuthenticated()" /> <sec:form-login login-page="/login" login-processing-url="/user/login" default-target-url="/" username-parameter="email" password-parameter="password" authentication-failure-url="/login?error" always-use-default-target='true' /> <sec:logout invalidate-session="true" logout-url="/logout" logout-success-url="/login?logout" /> <!-- enable csrf protection --> <sec:csrf/> </sec:http> <sec:authentication-manager> <sec:authentication-provider> <sec:jdbc-user-service data-source-ref="dataSource" users-by-username-query="SELECT email, password, enabled FROM users WHERE email = ?" authorities-by-username-query="SELECT email, authority FROM authorities WHERE email = ?" /> </sec:authentication-provider> </sec:authentication-manager> </beans> **-tiles.xml** <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE tiles-definitions PUBLIC "-//Apache Software Foundation//DTD Tiles Configuration 2.0//EN" "http://tiles.apache.org/dtds/tiles-config_2_0.dtd"> <tiles-definitions> <definition name="classic" template="/WEB-INF/tiles/layouts/classic.jsp"> <put-attribute name="header" value="/WEB-INF/tiles/components/header.jsp" /> <put-attribute name="footer" value="/WEB-INF/tiles/components/footer.jsp" /> </definition> <definition name="*/*" extends="classic"> <put-attribute name="content" value="/WEB-INF/views/{1}/{2}.jsp" /> </definition> </tiles-definitions> **-header.jsp** <%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%> <%@ taglib uri="http://www.springframework.org/security/tags" prefix="sec"%> <%@ page pageEncoding="utf-8"%> <nav class="navbar navbar-default"> <!-- Brand and toggle get grouped for better mobile display --> <div class="navbar-header"> <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#bs-example-navbar-collapse-1" aria-expanded="false"> <span class="sr-only">Toggle navigation</span> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button> <img src="https://d1ujqdpfgkvqfi.cloudfront.net/favicon-generator/htdocs/favicons/2019-05-08/79299a0a215820c658abb26740fbfbe6.ico.png" width="50" height="50" align="left"> <a class="navbar-brand" href="/" style="vertical-align:middle;">마이무빙</a> </div> <!-- Collect the nav links, forms, and other content for toggling --> <div class="collapse navbar-collapse" id="bs-example-navbar-collapse-1"> <ul class="nav navbar-nav"> <li><a href="<c:url value="/movies" />">영화</a></li> </ul> <!-- 로그인 버튼 --> <sec:authorize access="isAnonymous()"> <c:url var="loginUrl" value="/login" /> <ul class="nav navbar-nav navbar-right"> <li><a href="${ loginUrl }">로그인</a></li> </ul> </sec:authorize> <!-- 로그아웃 버튼 --> <sec:authorize access="isAuthenticated()"> <c:url var="logoutUrl" value="/logout" /> <form action="${logoutUrl}" method="post" class="navbar-form navbar-right"> <button type="submit" class="btn btn-default">로그아웃</button> <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" /> </form> </sec:authorize> <!-- /.navbar-collapse --> </div> <!-- /.container-fluid --> </nav>