title: How do you include a CSRF token in a Vue.js application with a Spring Boot backend?
body: <p>I'm trying to do a POST request to my backend REST API using the browser's Fetch API like this: </p>
  
  <pre><code>   submitRegistration() {
           const formElement = document.getElementById('register-form');
           fetch('http://localhost:8080/register', {
               method: 'POST',
               body: new FormData(formElement),
           });
       }
  </code></pre>
  
  <p>I'm taking the data from this form: </p>
  
  <pre><code>&lt;v-form id="register-form" @submit.prevent="submitRegistration" class="text-center" ref="form" v-model="valid" lazy-validation&gt;
      &lt;v-text-field type="text" name="username" v-model="form.username" :counter="25" :rules="usernameRules" label="Username" required&gt;&lt;/v-text-field&gt;
      &lt;v-text-field type="password" name="userPassword" v-model="form.password" :counter="25" :rules="passwordRules" label="Password" required&gt;&lt;/v-text-field&gt;
      &lt;v-text-field type="text" name="userEmail" v-model="form.email" :rules="emailRules" label="E-mail" required&gt;&lt;/v-text-field&gt;
      &lt;v-btn type="submit" text class="primary"&gt;Register&lt;/v-btn&gt;
  &lt;/v-form&gt;
  </code></pre>
  
  <p>However, as a response I get <strong>403 Forbidden</strong> by my backend server. The problem is the CSRF token but I have no idea how to generate it to include it in the POST request to the backend API.</p>
  
  <p><strong>EDIT</strong>: In Spring Boot, my CORS mapping is configured like this: </p>
  
  <pre><code>@Bean
  public WebMvcConfigurer corsConfigurer() {
      return new WebMvcConfigurer() {
          public void addCorsMappings(CorsRegistry registry) {
              registry.addMapping("/**").allowedOrigins("http://localhost:9000").allowCredentials(true);
          }
      };
  }
  </code></pre>
  
  <p>I'm posting this because the <code>Response</code> object that is returned gives me a 403 status and is of type "cors" even though the error is resolved if I completely disable CSRF using HttpSecurity - <code>http.csrf().disable();</code></p>