The reason why the filters aren't disabled is that you have set the wrong config. You have this line: play.filters.disabled += "play.filters.csrf.CSRFFilter" but that's inside play.filters.csrf. So you're trying to add play.filters.csrf.CSRFFilter to play.filters.csrf.play.filters.disabled. If you move that line outside of the csrf bracket and replace it with disabled += "play.filters.csrf.CSRFFilter (still inside the play.filters bracket) it should work.