Missing CSRF token in REST request

Question

I'm writing a REST API using Spring MVC. I'm trying to access a controller method via a POST request.

I always receive a 403 error:

Invalid CSRF Token '' was found on the request parameter '_csrf' or header 'X-CSRF-TOKEN'.

How can I deliver a CSRF token within my REST request? I tried to use the default security password which is displayed during application startup as the value for _csrf but it wasn't successful.

How can I retrieve the CSRF token and is it correct to send the token in the _csrf parameter?

Answer 1

You will need to provide the correct header and CSRF token when making the request eg

request.setRequestHeader('${_csrf.headerName}', '${_csrf.token}');

You can also send the token as a request parameter using _csrf.parameterName .