Angularjs is receiving XSRF-TOKEN from spring boot but does not sends X-XSRF-TOKEN

Question

I've already setup the Spring Boot 1.5.x for CSRF. Testing on spring everything is ok: (1) server generates the token and send to the clien (2) if the client sends the token everything is ok.

With the web client I've the Spring Boot that serves as rest API (with http://localhost:8088/) and the angularjs as client (with http://localhost:9000) But it seams the problem is on angularjs, it sends the token on the header key XSRF-TOKEN instead of the X-XSRF-TOKEN (the one that spring is waiting for).

By reading the angularjs documentation this header key should be sent automatically (https://docs.angularjs.org/api/ng/service/$http#cross-site-request-forgery-xsrf-protection)

Where's a printscreen of the angularjs interaction with the spring boot

(1) GET xhr request that receives the spring boot csrf token

(2) POST xhr request that needs to send the token with name

In spring I use use a CORS filter and just use spring security feature to generate the CSRF tokens

.csrf()
    .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())

In the angularjs I've already tried to define the header key by a interceptor (just trying out solutions)

$httpProvider.defaults.xsrfHeaderName = 'X-XSRF-TOKEN';

var interceptor = ['$rootScope', '$q', 'httpBuffer', '$cookieStore', function ($rootScope, $q, httpBuffer, $cookieStore) {
    return {
        'request': function (config, a, b) {
            return config;
        },

        'requestError': function (rejection) {
            return $q.reject(rejection);
        },

        'response': function (response) {
            $httpProvider.defaults.headers.common['X-XSRF-TOKEN'] = response.headers('XSRF-TOKEN');
            return response;
        },

        'responseError': function (rejection) {

            console.log('rejection', rejection.headers());

            var deferred = $q.defer();

            return $q.reject(rejection);
        }
    };
}];

$httpProvider.interceptors.push(interceptor);

pdorgambide pdorgambide · Accepted Answer · 2018-01-04T00:39:10

Need store the token on response and send it on request. If you need send on all request override the request method on the interceptor:

request: function (config) {
      config.headers['x-xsrf-token'] = stored_token;

      return config;
    }

Otherwise send it on a single $http request.

Angularjs is receiving XSRF-TOKEN from spring boot but does not sends X-XSRF-TOKEN

1 Answers