SpringBoot - Angular 5 - CSRF

Viewed 6676

Iam lost now and need some help.

I have a

  • SpringBoot Server with SpringSecurtiy 4.3.
  • Angular 5 App

And want to enable CSRF protection since it should be enabled on both by default (says the docs) :Its NOT!

On SpringBoot I need to add these security configs:

http
.csrf()
.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());

On Angular I need to add these Modules:

imports: [
    ...,
    HttpClientModule,
    HttpClientXsrfModule, //(!)
...

Bottom line the server send the XRSF-TOKEN in each response.

-But a diffrent on each one. Is that correct? I expected to be the same on a client session.

-Main problem here is that Angular5 still didnt use the XRSF-TOKEN in its post calls (e.g.). It dont set a X-XSRF-TOKEN in its requests.

What am I doing wrong or missing?

1 Answers
Related