x-xsrf-token

Posting data from the form submit via API was successful. But after adding X-CSRF-TOKEN to the header and setting withCredentials: true resulted data were not posted to the script named insert.php Error: Failed to load http://localhost/simple_api/insert.php : Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. Origin ' http://localhost:4200 ' is therefore not allowed access. The credentials mode of requests initiated by the

Recently Safari 11 was released on Mac OSX. This update causes problem with our webapplication in combination with XSRF on the header of our reuest. I will try to describe the problem in a logic way. This is how a good situation would look like: When a user wants to log in, he receives a response from the server with a Set-Cookie that contains the value of the XSRF token. Eg: Set-Cookie: XSRF-TOKEN=LKNBX4DZhL708KjXNkgXnlxTDCNuhsZG1kTc2SFy498; Path=/; Secure The page refreshes The next call that will be executed contains that correct XSRF value in the header. On the server side the value is

I've read the docs and all the related questions on SO, but still Angular's XSRF mechanism isn't working for me: in no way I can make a POST request with the X-XSRF-TOKEN header appended automatically. I have an Angular 6 app with a login form. It's part of a Symfony (PHP 7.1) website, and the Angular app page, when served from Symfony, sends the correct Cookie ( XSRF-TOKEN ): My app.module.ts includes the right modules: // other imports... import {HttpClientModule, HttpClientXsrfModule} from "@angular/common/http"; // ... @NgModule({ declarations: [ // ... ], imports: [ NgbModule.forRoot(),

In angular documentation, it is mentioned that the angular httpclient will automatically send the value of cookie XSRF-TOKEN in the header X-XSRF-TOKEN of post request. Documentation link But it does not send the header for me. Here is my code Nodejs code to set the cookie router.get('/set-csrf',function(req,res,next){ res.setHeader('Set-Cookie', "XSRF-TOKEN=abc;Path=/; HttpOnly; SameSite=Strict"); res.send(); }) I have used the httpclient in app.module.ts imports: [ HttpClientModule ] ** The above code is just for debug purpose. I do not have a set-csrf endpoint. But it does not send any