Angular Development - API Server doesn't accept requests because of a missing XSRF Token

In development you could login with the following query parameter noxsrf (http://localhost:8182/imx/login/mycustomapi?noxsrf=true).

Regards,

Rodney

Hello Ivo,

It almost sounds like you set the API configuration setting XsrfProtectionCookiePath  to "/ApiServer". Could that be the case?

If that is so, you will need to set it again to "/" in the local API configuration of the server running on localhost:8182.

Hanno, how do you set that setting when runing with imxclient run-apiserver?

ah right, figured it out

Hi Jon,

Can you share the details?

Thx,

Rodney

Hello Everyone,

sorry for not answering, i didn't even realise that the thread was active. The moderation policy had me confused.

I solved this problem by disabling CSRF protection in my development environment.  API-Server-> Admin-Portal-> Configuration -> Category: IMX  -> Globally disable CSRF protection tokens

Hello Hanno,

do I understand correctly - if you have a local API server (localhost) the setting "XsrfProtectionCookiePath" is to be set to the value "/".
How should the value be set if you have an API server that is not running locally?

Hi Ivo,

thanks for the answer - short question - what to do if this setting is not saved?
We have saved it locally and globally - but this value is not saved.

Hi,

if you save it locally it should be changed till the server is restarted. If you change it globally, it should change a configuration-file and save the change for all servers. If it doesn't, there maybe a problem with file permissions or a more general bug.

We had a problem with saving changes in the Admin Portal and reported a bug. But that only concerned lists, like which fields to display for editing persons.

There is no general answer to your question, it depends on your setup. What is the URL of the API Server?

Basically, the HTML app needs to access the cookies emitted by the API Server. You need to set that property only if your HTML apps run on a different domain/path than the API Server. (Having them both on localhost with different ports usually works fine.)