title: CSRF Token in Master/Slave environment
body: <p>I've implemented a REST service using Spring web services, with CSRF security enabled in spring-security.xml, as below</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:security="http://www.springframework.org/schema/security"
         xsi:schemaLocation="http://www.springframework.org/schema/security
                             http://www.springframework.org/schema/security/spring-security-3.2.xsd
                             http://www.springframework.org/schema/beans
                             http://www.springframework.org/schema/beans/spring-beans-4.1.xsd"&gt;
      &lt;security:http&gt;
          &lt;security:csrf/&gt;
      &lt;/security:http&gt;
  &lt;/beans&gt;
  </code></pre>
  
  <p>This application is deployed on two tomcat 7.0 servers in a master/slave setup, with apache used as a load balancer. </p>
  
  <p>Some requests are being rejected by the server, throwing a security exception that the CSRF token is invalid. </p>
  
  <p>I think a request with a valid CSRF token for the master server is being redirected to the slave, and vice versa, which is causing the exception. Can you configure security so that a valid token for either server is accepted by the other?</p>