How to make Postman show CSRF token from get request using postman interceptor - spring-boot

Question

I'm having specific problem that I would like to find solution to. I'm working with my spring security and I should use Postman Interceptor to retrieve X-CSRF-TOKEN in Cookies section. I installed postman interceptor, and this is my spring security code with enabled csrf
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/", "index", "/css/*", "/js/*").permitAll()
.antMatchers("/api/**").hasRole(STUDENT.name())
.anyRequest()
.authenticated()
.and()
.httpBasic();
}
Now I'm not getting any cookies beside some SESSIONID and I've not idea how I should set up interceptor on this postman that will retrieve me cookies after enabling postmang interceptor, so if you could be kind and lead me? I've been struggling with this for days, and I also tried few approaches from here and ask on different groups, but no luck. Thanks in advance. Also I have user with pw for basic auth if needed and this is what I only get from postman https://prnt.sc/74GGlfA4TYYN

Answer 1

In my case I usually configure Spring Security to use a CookieCsrfTokenRepository, like so:
http.csrf(csrf -> csrf
.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnly(false)
);
And in my Postman requests, I add this script in the Tests tab.
var xsrfCookie = postman.getResponseCookie("XSRF-TOKEN");
pm.environment.set("xsrf-token", decodeURIComponent(pm.cookies.get("XSRF-TOKEN")))
In the Headers section of your request in Postman, you should have a header like this:
Key
Value
X-XSRF-TOKEN
{{xsrf-token}}
With this setup, Postman will retrieve the Cookie with the CSRF token returned from your backend and add it as an environment variable so you can use it in the next requests.