title: CSRF - Axios is removing headers
body: <p>I am using Axios module for Nuxt.js. </p>
  
  <p>I do have problem with <code>CSRF</code> token. Whenever I log in into the app, I cannot send any <code>POST</code> request. The response is always <code>403</code>.</p>
  
  <p><strong><em>Axios configuration:</em></strong></p>
  
  <p><strong>Inside <code>nuxt.config.js</code></strong></p>
  
  <pre><code>axios: {
      debug: true,
      credentials: true,
      baseURL: `${process.env.API_PROTOCOL}://${process.env.API_HOST}${process.env.API_PORT ? `:${process.env.API_PORT}` : ''}${process.env.API_PREFIX}`,
  },
  </code></pre>
  
  <p><strong>Inside 'axios.js' plugin / interceptor</strong></p>
  
  <pre><code>const EXPIRED_TOKEN_MESSAGE = 'Expired JWT Token';
  
  export default function ({
      $axios, redirect, store,
  }) {
      $axios.setHeader('Content-Type', 'application/json');
      $axios.setHeader('Accept', 'application/json');
  
  
      $axios.onRequest((config) =&gt; {
          const configLocal = config;
  
          if (config.method === 'post') {
              configLocal.headers['X-Requested-With'] = 'XMLHttpRequest';
              configLocal.headers['x-csrf-token'] = store.state.authentication.csrf;
          }
      });
  
      $axios.onError((error) =&gt; {
          const { response: { data: { message } } } = error;
          // const msg = status === 500 ? 'Internal Server Error' : message;
          if (message === EXPIRED_TOKEN_MESSAGE &amp;&amp; store.state.authentication.csrf) {
              store.dispatch('authentication/logout');
              return redirect('/');
          }
  
          if (process.client) {
              // store.dispatch('alerts/addAlert', { type: 'error', message: msg });
          }
  
          return Promise.reject(error.response);
      });
  }
  </code></pre>
  
  <p><strong>Request call:</strong> </p>
  
  <pre><code>this.app.$axios.$post('resources/add', data).then(() =&gt; {
          }).catch(e =&gt; console.log(e));
  </code></pre>
  
  <p>Reproduction steps - under the hood of request:</p>
  
  <p><a href="https://i.stack.imgur.com/WDhGa.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/WDhGa.png" alt="enter image description here"></a></p>
  
  <p>After I printed request config inside <code>$axios.onRequest</code> as we can see from above everything is set, but in networking not at all</p>
  
  <p><a href="https://i.stack.imgur.com/Nmm9J.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Nmm9J.png" alt="enter image description here"></a></p>
  
  <p>Going further backend server is not receiving any headers: </p>
  
  <p><a href="https://i.stack.imgur.com/YLWfi.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/YLWfi.png" alt="enter image description here"></a></p>
  
  <p>With console log:</p>
  
  <pre><code>`2019-07-04 18:45:18.380 DEBUG 712 --- [nio-8080-exec-1] w.c.HttpSessionSecurityContextRepository : No HttpSession currently exists
  2019-07-04 18:45:18.380 DEBUG 712 --- [nio-8080-exec-1] w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: null. A new one will be created.`
  </code></pre>
  
  <p>Any ideas what's wrong ?</p>