javascript - How do I send CSRF tokens from AngularJS front end to Spring REST service backend? -

how set csrf protection between angularjs front end , spring boot rest backend? let's take http.post("/send-pin", jsonobject)... call code below example.

i getting following error in server logs when try call spring boot rest service @ /send-pin url pattern angularjs front end method using http.post("/send-pin", jsonobject)...:

invalid csrf token found http://localhost:9000/send-pin 

i read this other posting, states csrf token needs set in angularjs code makes request, code in link uses syntax $(document).ajaxsend(function(e, xhr, options) {xhr.setrequestheader('x-csrf-token', token);});, not directly paste code below. also, clode in link takes data form, while code takes data angularjs controller. what specific changes need made code below backend rest service process request made angularjs app rest service running @ localhost:9000/send-pin url?

here method in angularjs:

$scope.login = function() {     auth.authenticate1($scope.credentials, function(authenticated1) {         if (authenticated1) {//authenticated1 returns true             var resultmessage = { "name": $scope.credentials.username };             $http.post('/send-pin', resultmessage).then(function(response) {//this call triggers invalid csrf token error shown above                 $scope.processstep = response.data.content;                 auth.usrname = response.data.name;             });             $scope.error = false;         } else {             $scope.error = true;         }     }) } 

here uiapplication.java class sets springsecurity configuration:

@springbootapplication @controller @enablejparepositories(basepackages = "demo", considernestedrepositories = true) public class uiapplication extends webmvcconfigureradapter {      // match without suffix (so not static resource)     @requestmapping(value = "/{[path:[^\\.]*}")     public string redirect() {         // forward home page route preserved.         return "forward:/";     }      @requestmapping("/user")     @responsebody     public principal user(httpsession session, principal user) {         return user;     }      public static void main(string[] args) {         springapplication.run(uiapplication.class, args);     }      @bean     public localeresolver localeresolver() {         sessionlocaleresolver slr = new sessionlocaleresolver();         slr.setdefaultlocale(locale.us);         return slr;     }      @bean     public localechangeinterceptor localechangeinterceptor() {         localechangeinterceptor lci = new localechangeinterceptor();         lci.setparamname("lang");         return lci;     }      @override     public void addviewcontrollers(viewcontrollerregistry registry) {         registry.addviewcontroller("/login").setviewname("login");     }      @override     public void addinterceptors(interceptorregistry registry) {         registry.addinterceptor(localechangeinterceptor());     }      @order(ordered.highest_precedence)     @configuration     protected static class authenticationsecurity extends globalauthenticationconfigureradapter {          @autowired         private users users;          @override         public void init(authenticationmanagerbuilder auth) throws exception {             auth.userdetailsservice(users);         }     }      @suppresswarnings("deprecation")     @configuration     @order(securityproperties.access_override_order)     @enablewebmvcsecurity     @enableglobalmethodsecurity(prepostenabled = true)     protected static class securityconfiguration extends websecurityconfigureradapter {          @override         protected void configure(httpsecurity http) throws exception {             http.httpbasic().and().authorizerequests()                 .antmatchers("/check-pin").permitall()                 .antmatchers("/index.html", "/", "/login", "/someotherrurl")                  .permitall().anyrequest().authenticated().and().csrf()                 .csrftokenrepository(csrftokenrepository()).and()                 .addfilterafter(csrfheaderfilter(), csrffilter.class);         }          private filter csrfheaderfilter() {             return new onceperrequestfilter() {                 @override                 protected void dofilterinternal(httpservletrequest request, httpservletresponse response, filterchain filterchain) throws servletexception, ioexception {                     csrftoken csrf = (csrftoken) request.getattribute(csrftoken.class.getname());                     if (csrf != null) {                         cookie cookie = webutils.getcookie(request, "xsrf-token");                         string token = csrf.gettoken();                         if (cookie == null || token != null && !token.equals(cookie.getvalue())) {                             cookie = new cookie("xsrf-token", token);                             cookie.setpath("/");             response.addcookie(cookie);                         }                     }                     filterchain.dofilter(request, response);                 }             };         }          private csrftokenrepository csrftokenrepository() {             httpsessioncsrftokenrepository repository = new httpsessioncsrftokenrepository();             repository.setheadername("x-xsrf-token");             return repository;         }     }    } 

here error log linux terminal prints out while rest service running:

2016-01-15 13:15:27.704 debug 7031 --- [nio-9000-exec-1] trepository$savetosessionresponsewrapper : skip invoking on 2016-01-15 13:15:27.704 debug 7031 --- [nio-9000-exec-1] trepository$savetosessionresponsewrapper : skip invoking on 2016-01-15 13:15:27.704 debug 7031 --- [nio-9000-exec-1] o.s.s.w.a.exceptiontranslationfilter     : chain processed 2016-01-15 13:15:27.704 debug 7031 --- [nio-9000-exec-1] s.s.w.c.securitycontextpersistencefilter : securitycontextholder cleared, request processing completed 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/css/**' 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/js/**' 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/images/**' 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/**/favicon.ico' 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/error' 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/autoconfig'] 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/autoconfig' 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/autoconfig/**'] 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/autoconfig/**' 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/autoconfig.*'] 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/autoconfig.*' 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/autoconfig/'] 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/autoconfig/' 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/metrics'] 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/metrics' 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/metrics/**'] 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/metrics/**' 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/metrics.*'] 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/metrics.*' 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/metrics/'] 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/metrics/' 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/trace'] 2016-01-15 13:15:27.713 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/trace' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/trace/**'] 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/trace/**' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/trace.*'] 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/trace.*' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/trace/'] 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/trace/' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/env'] 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/env' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/env/**'] 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/env/**' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/env.*'] 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/env.*' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/env/'] 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/env/' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/health'] 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/health' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/health/'] 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/health/' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/mappings'] 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/mappings' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/mappings/**'] 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/mappings/**' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/mappings.*'] 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/mappings.*' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/mappings/'] 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/mappings/' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/dump'] 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/dump' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/dump/**'] 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/dump/**' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/dump.*'] 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/dump.*' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/dump/'] 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/dump/' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/error'] 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/error' 2016-01-15 13:15:27.714 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/error/'] 2016-01-15 13:15:27.715 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/error/' 2016-01-15 13:15:27.715 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/beans'] 2016-01-15 13:15:27.716 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/beans' 2016-01-15 13:15:27.716 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/beans/**'] 2016-01-15 13:15:27.716 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/beans/**' 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/beans.*'] 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/beans.*' 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/beans/'] 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/beans/' 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/info'] 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/info' 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/info/'] 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/info/' 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/configprops'] 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/configprops' 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/configprops/**'] 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/configprops/**' 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/configprops.*'] 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/configprops.*' 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : trying match using ant [pattern='/configprops/'] 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.s.w.u.matcher.antpathrequestmatcher  : checking match of request : '/send-pin'; against '/configprops/' 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.s.web.util.matcher.orrequestmatcher  : no matches found 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.security.web.filterchainproxy        : /send-pin @ position 1 of 12 in additional filter chain; firing filter: 'webasyncmanagerintegrationfilter' 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.security.web.filterchainproxy        : /send-pin @ position 2 of 12 in additional filter chain; firing filter: 'securitycontextpersistencefilter' 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] w.c.httpsessionsecuritycontextrepository : obtained valid securitycontext spring_security_context: 'org.springframework.security.core.context.securitycontextimpl@d8393cb4: authentication: org.springframework.security.authentication.usernamepasswordauthenticationtoken@d8393cb4: principal: org.springframework.security.core.userdetails.user@63d9948c: username: another@shirt.com; password: [protected]; enabled: true; accountnonexpired: true; credentialsnonexpired: true; accountnonlocked: true; granted authorities: role_user; credentials: [protected]; authenticated: true; details: org.springframework.security.web.authentication.webauthenticationdetails@fffdaa08: remoteipaddress: 127.0.0.1; sessionid: 61483b5ddc3336ec44bf528c97749aa9; granted authorities: role_user' 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.security.web.filterchainproxy        : /send-pin @ position 3 of 12 in additional filter chain; firing filter: 'headerwriterfilter' 2016-01-15 13:15:27.717 debug 7031 --- [io-9000-exec-10] o.s.s.w.header.writers.hstsheaderwriter  : not injecting hsts header since did not match requestmatcher org.springframework.security.web.header.writers.hstsheaderwriter$securerequestmatcher@4f81666 2016-01-15 13:15:27.723 debug 7031 --- [io-9000-exec-10] o.s.security.web.filterchainproxy        : /send-pin @ position 4 of 12 in additional filter chain; firing filter: 'csrffilter' 2016-01-15 13:15:27.724 debug 7031 --- [io-9000-exec-10] o.s.security.web.csrf.csrffilter         : invalid csrf token found http://localhost:9000/send-pin 2016-01-15 13:15:27.725 debug 7031 --- [io-9000-exec-10] s.s.w.c.securitycontextpersistencefilter : securitycontextholder cleared, request processing completed 

$.ajaxsend work jquery $.ajax , not other ajax calls made library or framework such angular.

from angular $http docs:

xsrf technique unauthorized site can gain user's private data. angular provides mechanism counter xsrf. when performing xhr requests, $http service reads token cookie (by default, xsrf-token) , sets http header (x-xsrf-token).

so make sure set appropriate cookie , angular take care of header internally