POST /api/user/admin HTTP/1.1

...

username=admin&groups=administrators&email=admin%40example.com&totp_enabled=false&storage_quota=0&storage_current=0&disabled=false&password=superSecure&passwordconfirm=superSecure&csrf_token=<randomly generated token>

package com.sismics.docs.rest.util;

import java.util.Map;
import java.util.HashMap;
import java.security.SecureRandom;
import com.sismics.docs.rest.util.RandomTokenGenerator;

/**
 * CSRF Token Class that manages users' CSRF Token
 */
public class CSRFToken {

    private static CSRFToken instance = new CSRFToken();
    private Map<String, String> tokenMap = new HashMap<String, String>();

    private CSRFToken() {}

    public static CSRFToken getInstance() {
        return instance;
    }

    public void setToken(String userName, String token) {
        tokenMap.put(userName, token);
    }

    public String getToken(String userName) {
        if (tokenMap.containsKey(userName)) {
            return tokenMap.get(userName);
        }
        // avoid using predictable string because bruteforcing this value could lead to bypass CSRF check
        return RandomTokenGenerator.generate();
    }

    public boolean validate(String userName, String token) {
        return this.getToken(userName).equals(token);
    }
}

package com.sismics.docs.rest.util;

import java.security.SecureRandom;
import java.lang.StringBuilder;
import java.lang.String;

/**
 * A token generator for CSRF Token
 */
public class RandomTokenGenerator {

    public static String generate() {
        byte[] bytes = new byte[16];
        SecureRandom rand = new SecureRandom();
        rand.nextBytes(bytes);
        StringBuilder sb = new StringBuilder();
        for (byte b : bytes) {
            sb.append(String.format("%02x", b));
        }
        return sb.toString();
    }
}