try to add follow to the HttpSecurity configuring:
http .authorizeHttpRequests(auth -> auth .csrf(csrf -> csrf.disable()) //...