code: public void insertAntiCsrfFormField(PrintWriter out)
      {
          if (!insertedAntiRedressHtml) {
              throw new IllegalStateException("Must call insertAntiRedressHtml() before calling this.");
          }
  
          // SECURITY TODO: Generate a real token.  This dummy token is obviously insecure.
          String token = "dummy";
  
          out.println("<input type='hidden' name='" + antiCsrfTokenName + "' value='" + escapeHtml4(token) + "' />");
      }
docs: Call this right after you print the opening "<form>" tag.