Angular · Senior · Question 35 of 75
How does HttpClient help protect against CSRF?
- ✓Correct answer: It reads the
XSRF-TOKENcookie and sends it as anX-XSRF-TOKENheader on mutating requests to same-origin URLs - 2It encrypts every request body
- 3It blocks all cross-origin requests
Explanation
The server must set the cookie and verify the header. Angular doesn't add the header to GET/HEAD requests or absolute URLs to avoid leaking the token to other domains.