title: CSRF issue while sending POST request from Angular 2 to Spring-backed Java app
body: <p>I have UI written with <strong>Angular 2</strong> and Java based backend that uses OpenID Connect authentication on top of <strong>Spring Security</strong>.</p>
  
  <p>The authentication works fine but only for GET requests. I'm getting HTTP 403 every time I perform POST, PUT or DELETE methods on a resource:</p>
  
  <pre><code>{
    "status": 403,
    "message": "Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-CSRF-TOKEN'.",
  }
  </code></pre>
  
  <p>I use HttpClient like this:</p>
  
  <pre><code>http.post(
      '/api/my-resource',
      JSON.stringify(myObject),
      new RequestOptions({
          headers: new Headers({'Content-Type': 'application/json'})
      })
  )
  </code></pre>
  
  <p>When I add <code>withCredentials: true</code> to the RequestOptions as proposed <a href="https://stackoverflow.com/questions/38929045/angular-2-spring-security-csrf-implementation-problems">here</a> I still get HTTP 403 but with different message:</p>
  
  <pre><code>{
    "status": 403,
    "message": "Could not verify the provided CSRF token because your session was not found.",
  }
  </code></pre>
  
  <p>What do I need to do to make <code>HttpClient</code> work with CSRF? </p>
  
  <p>Note: I also took a look at similar questions, especially <a href="https://stackoverflow.com/questions/38929045/angular-2-spring-security-csrf-implementation-problems">angular-2-spring-security-csrf-implementation-problems</a>, but the solutions proposed there do not solve my problem.
  At the same time I don't want to disable CSRF.</p>