title: Can't verify CSRF token! Angular 2 & spring security
body: <p>We're trying to implement a simple user login with angular 2 and spring security. But we are getting a 403 status back with the response: </p>
  
  <blockquote>
    <p>{"timestamp":1478525053048,"status":403,"error":"Forbidden","message":"Could not verify the provided CSRF token because your session was not found.","path":"/login"}</p>
  </blockquote>
  
  <p>login.html:</p>
  
  <pre><code>&lt;form&gt;
  &lt;div class="form-group"&gt;
      &lt;hr&gt;
    &lt;label&gt;Username:&lt;/label&gt;
    &lt;input class="form-control input-sm" id="user" type="text" name="user" [(ngModel)]="loginData.user" required&gt;&lt;br&gt;
  &lt;/div&gt;
  &lt;div class="form-group"&gt;
    &lt;label&gt;Passwort:&lt;/label&gt;
    &lt;input class="form-control input-sm" id="password" type="password" name="password" [(ngModel)]="loginData.passwordLogin" required&gt;
  &lt;/div&gt;
  &lt;!--&lt;input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}" /&gt;--&gt;
  &lt;input type="submit" value="Login" class="btn btn-default" (click)="login()"&gt;
  </code></pre>
  
  <p></p>
  
  <p>http-service.ts:</p>
  
  <pre><code>    login(username, pwd){
      console.log(username, pwd);
      var json = JSON.stringify({'password':pwd,'username':username});
      var headers = new Headers();
      headers.append('Content-Type','application/json');
      headers.append('authorization', 'Basic');
      return this._http.post('http://localhost:8080/login', json, {
          headers: headers
      }).map(res =&gt; res.json());
  }
  </code></pre>
  
  <p>SecurityConfiguration.java:</p>
  
  <pre><code>@EnableWebSecurity
  @Configuration
  // @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      System.out.println("loaded config");
      http.httpBasic() //
              .and() //
              .authorizeRequests() //
              .antMatchers("/login").permitAll() //
              .anyRequest().authenticated() //
              .and().formLogin().loginPage("http://localhost:3000/login")//
              .loginProcessingUrl("/login")//
              .successHandler(successHandler()).failureHandler(failureHandler()).and()//
              .addFilterAfter(new CsrfHeaderFilter(), CsrfFilter.class).csrf()//
              .csrfTokenRepository(csrfTokenRepository());//
  }
  
  private CsrfTokenRepository csrfTokenRepository() {
      final HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
      repository.setSessionAttributeName("_csrf");
      repository.setHeaderName("X-XSRF-TOKEN");
      return repository;
  }
  
  private AuthenticationSuccessHandler successHandler() {
      return new AuthenticationSuccessHandler() {
          @Override
          public void onAuthenticationSuccess(HttpServletRequest httpServletRequest,
                  HttpServletResponse httpServletResponse, Authentication authentication)
                  throws IOException, ServletException {
              httpServletResponse.getWriter().append("OK");
              httpServletResponse.setStatus(200);
          }
      };
  }
  
  private AuthenticationFailureHandler failureHandler() {
      return new AuthenticationFailureHandler() {
          @Override
          public void onAuthenticationFailure(HttpServletRequest httpServletRequest,
                  HttpServletResponse httpServletResponse, AuthenticationException e)
                  throws IOException, ServletException {
              httpServletResponse.getWriter().append("Authentication failure");
              httpServletResponse.setStatus(401);
          }
  
      };
  }
  </code></pre>
  
  <p>CsrfHeaderFilter.java:</p>
  
  <pre><code>public class CsrfHeaderFilter extends OncePerRequestFilter {
  @Override
  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
          throws ServletException, IOException {
      final CsrfToken csrf = (CsrfToken) request.getAttribute(CsrfToken.class.getName());
      if (csrf != null) {
          Cookie cookie = WebUtils.getCookie(request, "XSRF-TOKEN");
          final String token = csrf.getToken();
          if (cookie == null || token != null &amp;&amp; !token.equals(cookie.getValue())) {
              cookie = new Cookie("XSRF-TOKEN", token);
              cookie.setPath("/");
              response.addCookie(cookie);
          }
      }
      filterChain.doFilter(request, response);
  }
  
  }
  </code></pre>
  
  <p>The call:
  <a href="https://i.stack.imgur.com/1WXRR.png" rel="nofollow noreferrer">Headers etc.</a></p>
  
  <p><a href="https://i.stack.imgur.com/7AHDm.png" rel="nofollow noreferrer">loadOfLogin</a></p>