How is a CORS setup supposed to work with Angular's XSRF protection? Absolute URLs are just ignored, but I need XSRF to work with absolute URLs too. Shouldn't this be configurable with HttpClientXsrfModule.withOptions()? It seems like an oversight in the code.
Specifically, I see this in the Angular code:
https://github.com/angular/angular/blob/master/packages/common/http/src/xsrf.ts#L77-L84
// Skip both non-mutating requests and absolute URLs.
// Non-mutating requests don't require a token, and absolute URLs require special handling
// anyway as the cookie set
// on our origin is not the same as the token expected by another origin.
if (req.method === 'GET' || req.method === 'HEAD' || lcUrl.startsWith('http://') ||
lcUrl.startsWith('https://')) {
return next.handle(req);
}