It has to be said that Alibaba’s egg framework is quite good, with its own security verification.

Problem: get request is normal, post request background will report such an error.

" nodejs.ForbiddenError : invalid csrf token"

There is an official explanation for this problem. Click to jump to the official safety explanation of egg. There is not too much explanation here

Method 1: in the confit.default.js Add the following code to turn off security verification (not recommended)

config.security = {
    csrf: {
      enable: false,
    },
  };

Method 2: when the front-end initializes the interface, let the front-end get to request an interface first, and the background returns a secret key to the front-end. Let the front-end put it in the headers request header when the post request is made, and the egg will automatically verify the secret key, and the request will succeed only if the verification is successful.

1. Egg background code, get interface returns secret key: 2

async index() {
    const { ctx } = this;
    ctx.body = {
      csrf:ctx.csrf
    };
}

axios.post('apis/add', data,{headers:{'x-csrf-token': headData}})