Logout Issue (Invalid CSRF Token) about spring-addons HOT 3 CLOSED

If you follow the tutorials strictly, the logout should work in all 3 applications (with CSRF).

Angular automatically adds an X-XSRF-TOKEN header when a CSRF cookie is accessible to Javascript (http-only flag set to false in the cookie). So what you describe as workaround is actually what Angular does for us behind the scene. But Vue for instance don't do it and we have to do something like you propose. This is explained in section 7.4 Logout of the article.

Maybe did you miss the part with csrf: cookie-accessible-from-js in spring-addons client properties for the BFF?

from spring-addons.

Hi, so it turned out Angular issue since I used absolute URL for ex:

this.http.post(`http://localhost:7080/bff/logout`, null, {
....

Angular didn't include the XSRF-TOKEN from Cookie because of this code here.

So the solution is to use relative URL like the one in your example:

this.http.post(`/bff/logout`, null, {

Thanks 👍

from spring-addons.

Yep, that limitation with absolute URLs and CSRF is something to keep in mind when working with Angular :/

from spring-addons.