This addon will dynamically add the csrf headers for thymeleaf

In development/test/server builds you will get the following

  <meta name="_csrf_header" content="abc" />
  <meta name="_csrf" content="abc" />

In production you will get something that your thymeleaf templates can inject with

  <meta name="_csrf_header" th:content="${_csrf.headerName}" />
  <meta name="_csrf" th:content="${_csrf.token}" />

There is an initializer that will add an ajaxPrefilter to include the CSRF Header in every request.