title: 403 Forbidden when using csrf angularjs
body: <p>I use <a href="https://github.com/expressjs/csurf" rel="nofollow noreferrer">csurf</a> library in my project but it doesn't work. This is my code:</p>
  
  <p>server.js</p>
  
  <pre><code>var express      = require('express');
  var bodyParser   = require('body-parser');
  var cookieParser = require('cookie-parser');
  var csrf         = require('csurf');
  var line         = require('./server/line');
  
  app.use(cookieParser());
  var csrfProtection = csrf({ cookie: true})
  
  app.use(csrfProtection, function(req, res) {
      res.cookie('XSRF-TOKEN', req.csrfToken());
  });
  
  app.use(function (err, req, res, next) {
      if (err.code !== 'EBADCSRFTOKEN') return next(err) 
  
      res.status(403)
      res.send('form tampered with')
  })
  
  app.post('/getAccessTokenLINE', line.getAccessToken);
  </code></pre>
  
  <p>auth.js (I add '_csrf' into both header and body)</p>
  
  <pre><code>angular.module('auth', ['openline', 'ngCookies'])
      .config(function ($stateProvider) {
          //my config
      })
      .factory('Auth', function ($http, $window, $rootScope, $cookies) {
          return {
              getAccessTokenLINE: function() {
                  return $http.post($rootScope.server.url + '/getAccessTokenLINE', {
                      channelId     : $window.sessionStorage.lineChannelId,
                      channelSecret : $window.sessionStorage.lineChannelSecret,
                      callbackURL   : $window.sessionStorage.callbackURL,
                      getTokenURL   : $window.sessionStorage.lineGetTokenURL,
                      code          : $window.sessionStorage.authorizationCode,
                      _csrf         : $cookies._csrf
                  },
                  {
                      headers: {
                          _csrf         : $cookies._csrf
                      }
                  });
          }
  }
  </code></pre>
  
  <p>line.js (The 403 Forbidden error occurred when I send request to my API (/getAccessTokenLINE) , so I think this file is not important)</p>
  
  <pre><code>var request = require('request');
  
  function getAccessToken(req, res, next) {
      var channelId         = req.body.channelId;
      var channelSecret     = req.body.channelSecret;
      var callbackURL       = req.body.callbackURL;
      var getTokenURL       = req.body.getTokenURL;
      var authorizationCode = req.body.code;
  
      request.post({
          uri: getTokenURL,
          headers: {
              'Content-Type': 'application/x-www-form-urlencoded'
          },
          form: {
              grant_type    : 'authorization_code',
              client_id     : channelId,
              client_secret : channelSecret,
              redirect_uri  : callbackURL,
              code          : authorizationCode
          }
      }, function(error, response, body) {
          if (!error &amp;&amp; response.statusCode == 200) {
              return res.send(body);
          } else {
              return res.send(response.statusCode, error);
          }
      });
  }
  </code></pre>
  
  <p>I tried to change</p>
  
  <pre><code>var csrfProtection = csrf({ cookie: true})
  </code></pre>
  
  <p>to</p>
  
  <pre><code>var csrfProtection = csrf({ cookie: true, ignoreMethods: ['GET', 'POST', 'HEAD', 'OPTIONS']})
  </code></pre>
  
  <p>then I can access my API as normal. So, I think there is nothing wrong about setting.</p>
  
  <p>I don't understand what went wrong.</p>
  
  <p>EDIT: I found the solution.</p>
  
  <pre><code>app.use(cookieParser());
  app.use(csrf());
  app.use(function(req, res, next) {
      res.cookie('XSRF-TOKEN', req.csrfToken());
      return next();
  });
  </code></pre>