Angular Development - API Server doesn't accept requests because of a missing XSRF Token

Hello Ivo,

It almost sounds like you set the API configuration setting XsrfProtectionCookiePath  to "/ApiServer". Could that be the case?

If that is so, you will need to set it again to "/" in the local API configuration of the server running on localhost:8182.

Hello Hanno,

do I understand correctly - if you have a local API server (localhost) the setting "XsrfProtectionCookiePath" is to be set to the value "/".
How should the value be set if you have an API server that is not running locally?

There is no general answer to your question, it depends on your setup. What is the URL of the API Server?

Basically, the HTML app needs to access the cookies emitted by the API Server. You need to set that property only if your HTML apps run on a different domain/path than the API Server. (Having them both on localhost with different ports usually works fine.)

Hello Hanno,

thank you very much for your feedback. However, the details are all very vague and don't necessarily make the first steps easier - hence the specific question:
We have installed the API server on a Windows server with IIS - it can be accessed at.

https://<servername>.<domain>/ApiServer

What would have to be specified in this case?

Hello Hanno,

thank you very much for your feedback. However, the details are all very vague and don't necessarily make the first steps easier - hence the specific question:
We have installed the API server on a Windows server with IIS - it can be accessed at.

https://<servername>.<domain>/ApiServer

What would have to be specified in this case?

This will not work at all regardless of the cookie path, because your Angular frontend will typically run on HTTP (no "S") and cannot access cookies from a secure context. The browsers will not allow it.

In Chrome's F12 tools --> network tab, you can see this happening. By filtering on "blocked cookies" you can see if any cookies were blocked, and the browser will show the reason why.

We've had some success going HTTPS all the way, which means that your local Angular server needs to run in HTTPS. But it's probably not worth the hassle as long as you are in a development (non-production) environment, where it may be acceptable to just disable XSRF protection.