title: ERROR: POST http://localhost:8765/users/delete/delete8 403 (Forbidden)
body: <p>I'm using cakephp4. trying to add some sweetalert. Sweetalert is popping up when the delete button is clicked but when I click confirm for delete it's not deleting the data.</p>
  <p>template/layout/Users/index.php</p>
  <pre><code>&lt;table&gt;
  &lt;tr&gt;
      &lt;th&gt;Username&lt;/th&gt;
      &lt;th&gt;Usertype&lt;/th&gt;
      &lt;th&gt;Created&lt;/th&gt;
      &lt;th&gt;Action&lt;/th&gt;
  &lt;/tr&gt;
  
  &lt;?php foreach ($users as $user) : ?&gt;
      &lt;tr&gt;
          &lt;td&gt;
              &lt;?= $this-&gt;Html-&gt;link($user-&gt;username, ['action' =&gt; 'view', $user-&gt;slug]); ?&gt;
          &lt;/td&gt;
          &lt;td&gt;
              &lt;?= $this-&gt;Html-&gt;tag('span', $user-&gt;utype) ?&gt;
          &lt;/td&gt;
          &lt;td&gt;
              &lt;?= $user-&gt;created-&gt;format(DATE_RFC850); ?&gt;
          &lt;/td&gt;
          &lt;td&gt;
              &lt;?= $this-&gt;Html-&gt;link('Edit', ['action' =&gt; 'edit', $user- 
                 &gt;slug]); ?&gt; /
              
              &lt;a href=&quot;#&quot; class=&quot;delete&quot; data-slug=&quot;&lt;?=$user-&gt;slug? 
                 &gt;&quot;&gt;Delete&lt;/a&gt;
             
          &lt;/td&gt;
      &lt;/tr&gt;
  &lt;?php endforeach; ?&gt;
  </code></pre>
       
  <p>template/layout/Users/index.php</p>
  <pre><code>&lt;script&gt;
  
  deletes = document.getElementsByClassName('delete');
  Array.from(deletes).forEach((element) =&gt; {
    element.addEventListener(&quot;click&quot;, (e) =&gt; {
      let ajax_url = $(e.target).attr('data-slug');
      
      Swal.fire({
        title: 'Are you sure?',
        text: &quot;You won't be able to revert this!&quot;,
        icon: 'warning',
        showCancelButton: true,
        confirmButtonColor: '#3085d6',
        cancelButtonColor: '#d33',
        confirmButtonText: 'Yes, delete it!'
      }).then((result) =&gt; {
        if (result.isConfirmed) {
            $.ajax({
              method: 'POST',
              url: '/users/delete/'+ ajax_url,
              beforeSend: function(xhr){
                  xhr.setRequestHeader(
                      'X-CSRF-Token',
                      &lt;?= json_encode($this-&gt;request- 
                         &gt;getParam('_csrfToken')); ?&gt;
                  );
              },
              success: function(response){
                  if(response){
                      Swal.fire(
                          'Deleted!',
                          'Your file has been deleted.',
                          'success'
                      )
                  }
                  else {
                      Swal.fire({
                        icon: 'error',
                        title: 'Oops...',
                        text: 'No data deleted',
                   })
        }
              },
              error: function(e){
                  console.log('error', e);
              }
            })
         
        } 
      })
    })
  })
  </code></pre>
    
  <p>delete method is as follows in my UsersController.php</p>
  <p>UsersController.php</p>
  <pre><code>public function delete($slug)
  {
      $this-&gt;request-&gt;allowMethod(['post', 'delete']);
      $user = $this-&gt;Users-&gt;findBySlug($slug)-&gt;firstorFail();
      if ($this-&gt;Users-&gt;delete($user)) {
          $this-&gt;Flash-&gt;success(&quot;Deleted Successfully&quot;);
          return $this-&gt;redirect(['action' =&gt; 'index']);
      }
      $this-&gt;Flash-&gt;error('Unable to Delete user');
      return $this-&gt;redirect(['action' =&gt; 'index']);
  }
  </code></pre>
  <p>Route File is here
  config/route.php</p>
  <pre><code>  &lt;?php
  
     use Cake\Http\Middleware\CsrfProtectionMiddleware;
     use Cake\Routing\Route\DashedRoute;
     use Cake\Routing\RouteBuilder;
  
  
    $routes-&gt;setRouteClass(DashedRoute::class);
  
    $routes-&gt;scope('/', function (RouteBuilder $builder) {
  
     $builder-&gt;connect('/', ['controller' =&gt; 'Pages', 'action' =&gt; 
  'display', 'home']);
    
    $builder-&gt;connect('/users/delete/{slug}', ['controller' =&gt; 'Users', 
  'action' =&gt; 'delete']);
  
    $builder-&gt;connect('/pages/*', 'Pages::display');
  
    $builder-&gt;fallback();
  </code></pre>
  <p>});</p>