The XSRF cookie only becomes a header
for the page's own origin.
page: https://app.example.com/orders · cookie: XSRF-TOKEN=a7f3c9…
POST /api/notes
WHAT THE SERVER RECEIVES
content-type: application/json
x-xsrf-token: a7f3c9…
request origin https://app.example.com
page origin https://app.example.com · equal, so the
interceptor copies the cookie into the header
200 OKboth halves matched
POST https://api.example.com/api/notes
WHAT THE SERVER RECEIVES
content-type: application/json
no x-xsrf-token at all
request origin https://api.example.com
page origin https://app.example.com · different, so
the interceptor passes the request straight on
400 Bad Requestantiforgery: no request token
the rule, in one line
the interceptor skips GET and HEAD, then compares new URL(req.url, page).origin with the page's origin and skips the header when they differ — renaming the cookie or the header does not reach that comparison