javascript - XSRF-TOKEN 没有被 Angular 2 发送，因为它说默认情况下会发送

Question

我的登录请求的响应如下所示:-

• 它有 Cookie JSESSIONID 和 XSRF-TOKEN

现在另一个后续请求如下所示。我读到 Angular 2 默认情况下从 cookie 中获取值并附加到每个后续请求的 header ，但它没有这样做。

请让我知道我应该怎么做才能让 Angular 自动和全局处理它。

CORS 设置

res.set('Access-Control-Allow-Origin', req.headers.origin);
    res.set('Access-Control-Allow-Methods', 'GET, PUT, POST, DELETE,OPTIONS');
    res.set('Access-Control-Allow-Headers', 'X-Requested-With, Content-Type, Origin, Authorization, Accept, Client-Security-Token, Accept-Encoding');
    res.set('Access-Control-Allow-Credentials', true);

Answer 1

您正在发出 GET 请求并期待 XSRF token

By default, an interceptor sends this cookie on all mutating requests (POST, etc.) to relative URLs but not on GET/HEAD requests or on requests with an absolute URL.

https://angular.io/guide/http#security-xsrf-protection