Answers.Body: <p>The <a href="https://github.com/craftcms/commerce/blob/develop/src/controllers/CountriesController.php#L34-L39" rel="nofollow noreferrer">controller action you are hitting</a> returns a template and I think that it is why you are getting this error.</p>
  <p>If you don't have <code>headlessMode</code> on (<a href="https://craftcms.com/docs/3.x/config/config-settings.html#headlessmode" rel="nofollow noreferrer">docs</a>) you could make a quick template, add:</p>
  <pre><code>{% header &quot;Content-Type: application/json&quot;%}
  {{ craft.commerce.countries.getAllCountries() | json_encode() | raw }}
  </code></pre>
  <p>Which would give you an endpoint you can then reach from your front end.</p>
  <p>Alternatively, you could <a href="https://craftcms.com/docs/3.x/extend/" rel="nofollow noreferrer">make a small module/plugin</a> with a <a href="https://craftcms.com/docs/3.x/extend/controllers.html" rel="nofollow noreferrer">controller</a>.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-12-15T15:27:19.267Z
Answers.LastActivityDate: 2020-12-15T15:27:19.267Z
Answers.UserDisplayName: Oli
Answers.Body: <p>You need to provide a CSRF token, alternatively turn it off in your config/general.php file.</p>
  <p>Set a token in your twig template:</p>
  <pre><code>{% set csrfToken = {
      csrfTokenName: craft.app.config.general.csrfTokenName,
      csrfTokenValue: craft.app.request.csrfToken,
  } %}
  
  &lt;script type=&quot;text/javascript&quot;&gt;
      window.Craft = {{ csrfToken|json_encode|raw }};
  &lt;/script&gt;
  </code></pre>
  <p>Then include the CSRF token name and value in your post array (data):</p>
  <pre><code>data[window.Craft.csrfTokenName] = window.Craft.csrfTokenValue;
  </code></pre>
  <p>Alternatively you can set enableCsrfProtection to false in your general config file.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-12-15T11:51:15.837Z
Answers.Text: CSRF protection is disabled, still I'm getting an error. Also I use headless Craft together with decoupled frontend on Nuxt.js, so I need a way to fetch data with axios on Nuxt.js without using a twig template code.
Answers.UserDisplayName: Alex89
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-12-15T10:25:29.927Z
Answers.LastActivityDate: 2020-12-15T10:25:29.927Z
Answers.UserDisplayName: Syversen
Answers.Body: <p>After enabling the headless mode in Craft I'm getting the same error in JSON format:</p>
  <p><a href="https://i.sstatic.net/FVklc.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/FVklc.png" alt="enter image description here" /></a></p>
  <p>Anyway I guess I have to write some module for that extra functionality.
  Thank you for the tips!</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-12-15T17:44:24.000Z
Answers.LastActivityDate: 2020-12-15T17:44:24.000Z
Answers.UserDisplayName: Alex89
Body: <p>I need to fetch a list countries available for shipping in Craft Commerce.</p>
  <p>The problem is that I use decoupled frontend on Nuxt.js and I need fetch it with Ajax call and not with the twig code.</p>
  <p>I tried to call it in a Postman but it returns me a 403 - Forbidden error with message &quot;User is not permitted to perform this action&quot;.</p>
  <p>I couldn't find something about the way of making request through Ajax in Commerce documentation, can you please tell me what I'm doing wrong here?</p>
  <p><a href="https://i.sstatic.net/kQBJA.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/kQBJA.png" alt="enter image description here" /></a></p>
  
Tags: <ajax><plugin-craftcommerce3>
Title: Get a list of countries available for shipping with Ajax in Craft Commerce
ThreadText: # Get a list of countries available for shipping with Ajax in Craft Commerce
  
  (Asked by: username_0 on 2020-12-15)
  
  I need to fetch a list countries available for shipping in Craft Commerce.
  
  The problem is that I use decoupled frontend on Nuxt.js and I need fetch it with Ajax call and not with the twig code.
  
  I tried to call it in a Postman but it returns me a 403 - Forbidden error with message "User is not permitted to perform this action".
  
  I couldn't find something about the way of making request through Ajax in Commerce documentation, can you please tell me what I'm doing wrong here?
  
  [![enter image description here](https://i.sstatic.net/kQBJA.png)](https://i.sstatic.net/kQBJA.png)
  
  **Tags:** ajax, plugin-craftcommerce3
  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_1 on 2020-12-15. Score: 2
  
  The [controller action you are hitting](https://github.com/craftcms/commerce/blob/develop/src/controllers/CountriesController.php#L34-L39) returns a template and I think that it is why you are getting this error.
  
  If you don't have `headlessMode` on ([docs](https://craftcms.com/docs/3.x/config/config-settings.html#headlessmode)) you could make a quick template, add:
  
  ```
  {% header "Content-Type: application/json"%}
  {{ craft.commerce.countries.getAllCountries() | json_encode() | raw }}
  
  ```
  
  Which would give you an endpoint you can then reach from your front end.
  
  Alternatively, you could [make a small module/plugin](https://craftcms.com/docs/3.x/extend/) with a [controller](https://craftcms.com/docs/3.x/extend/controllers.html).
  
  
  ---
  
  ### Answer by username_2 on 2020-12-15. Score: 2
  
  You need to provide a CSRF token, alternatively turn it off in your config/general.php file.
  
  Set a token in your twig template:
  
  ```
  {% set csrfToken = {
      csrfTokenName: craft.app.config.general.csrfTokenName,
      csrfTokenValue: craft.app.request.csrfToken,
  } %}
  
  <script type="text/javascript">
      window.Craft = {{ csrfToken|json_encode|raw }};
  </script>
  
  ```
  
  Then include the CSRF token name and value in your post array (data):
  
  ```
  data[window.Craft.csrfTokenName] = window.Craft.csrfTokenValue;
  
  ```
  
  Alternatively you can set enableCsrfProtection to false in your general config file.
  
  > **Comments:**
  > **username_0**: CSRF protection is disabled, still I'm getting an error. Also I use headless Craft together with decoupled frontend on Nuxt.js, so I need a way to fetch data with axios on Nuxt.js without using a twig template code.  
  
  ---
  
  ### Answer by username_0 on 2020-12-15. Score: 1
  
  After enabling the headless mode in Craft I'm getting the same error in JSON format:
  
  [![enter image description here](https://i.sstatic.net/FVklc.png)](https://i.sstatic.net/FVklc.png)
  
  Anyway I guess I have to write some module for that extra functionality.
  Thank you for the tips!
  
  
  ---
  
  