title: CSRF protection with Angular + Spring Boot + REST + JWT
body: <p>I am working with an Angular + Spring Boot application and I use JWT for authorization (token stored in an http only cookie), the backend is fully developed with REST services. Now I am trying to use CSRF protection with Spring Security but I don't understand how it works. A new XSRF-TOKEN is always generated for each request, but even if you change it manually or delete it, subsequent requests are always successful.</p>
  <p>This is my code snippet regarding CSRF (i.e. what is written on all the guides):</p>
  <pre><code>http = http.cors().and().csrf().csrfTokenRepository(this.getCsrfTokenRepository());
  </code></pre>
  <p>...</p>
  <pre><code>private CsrfTokenRepository getCsrfTokenRepository() {
      CookieCsrfTokenRepository tokenRepository = CookieCsrfTokenRepository.withHttpOnlyFalse();
      tokenRepository.setCookiePath(&quot;/&quot;);
      return tokenRepository;
  }
  </code></pre>
  <p>Where am I doing wrong?</p>