When useSession is enabled in eggjs,csrf configuration, the ajax request reports an error of 403.

eggjs framework. When useSession is enabled in csrf configuration, ajax requests to report a 403 error. How to solve this problem?
if useSession is not enabled, simply add x-csrf-token to the ajax request header, and the csrftoken value is taken from the cookie.
but when useSession is enabled, csrfToken is stored in session, and the related cookie is http only.

security is configured as follows

  exports.security = {
    csrf: {
      useSession: true
    }
  };
Mar.21,2021
Menu