如何在第一个请求中传递 csrf-token

Question

my question is how cookies works, this question is arrived in my mind when i loaded my page for first time i got this

REQUEST HEADER
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
Cache-Control: max-age=0
Connection: keep-alive
Cookie: csrftoken=gsZxmbW4XUpE6YnaQhlrAx9JduyExVgzWEo4fXhcY4V3fbHWVtwf0msbDQDT5r43
Host: 127.0.0.1:8000
Upgrade-Insecure-Requests: 1

when first request was sent it already had csrftoken in cookie

i tried same in incognito window than also i got same result. how can my browser already have cookie without any communication to server

i am working on django with angular 7, problems is that i am sending my request from angular

 this.http.post('http://127.0.0.1:8000/',data,  {observe : "response", withCredentials: true } )}

but in response of that i am not getting any csrftoken in setcookie .

please help me ..... sorry for adding two problems in one question but both are indirectly connected to each other

Answer 1

actually thing was that django was running on 127.0.0.1 and angular was running on localhost( any loop back address) and that's why for security(CORS) issue, browser(chrome) was not allowing me to neither send cookie in request nor set cookie in response . so i had two options one change same-site to none in browser or change my angular setting to render on 127.0.0.1.

Answer 2

CSRF 只能停止到 PUT、POST 和 DELETE，它总是以 GET 请求打开，如果您能够在第一次通过 GET 发送它，那就太好了。