Dfyjkt

I am creating an SPA using Angular 6 for front end and Adonisjs for backend.

And now I got stuck in the problem csrf. If I disable csrf in adonis/config/shield.js I have complete my task. But, I don't want to disable csrf.

I have followed some suggestions on internet about using Angular HttpInterceptor but still not work.

here is csrf config in shield.js

csrf: 
enable: true,
methods: ['POST', 'PUT', 'DELETE'],
filterUris: ['/api/auth/signin'],
cookieOptions: 
 httpOnly: false,
 sameSite: true,
 path: '/',
 maxAge: 7200

// compareHostAndOrigin: true

And here is my token-interceptor.service.ts

 import Injectable from '@angular/core';
import 
 HttpClientXsrfModule,
 HttpInterceptor,
 HttpXsrfTokenExtractor,
 HttpRequest,
 HttpHandler,
 HttpEvent
 from '@angular/common/http';
import Observable from 'rxjs';

@Injectable()
export class TokenInterceptorService implements HttpInterceptor 
 constructor(private tokenExtractor: HttpXsrfTokenExtractor) 

 intercept(
 req: HttpRequest<any>,
 next: HttpHandler
 ): Observable<HttpEvent<any>> 
 const headerName = 'XSRF-TOKEN';
 const respHeaderName = 'X-XSRF-TOKEN';
 const token = this.tokenExtractor.getToken() as string;
 if (token !== null && !req.headers.has(headerName)) 
 req = req.clone( headers: req.headers.set(respHeaderName, token) );
 
 return next.handle(req);

 

And I don't know if the Angular intercept the Http. because from my request, I don't see any X-XSRF-TOKEN header.

And I still confuse about the token Adonisjs uses. because when I log in and console.log(request.csrfToken) I got a value but the value is different from token in database (I use mongoDB).

Should I got csrf from the beginning I open my app?
or something else?

Please suggest me how to fix it.