title: .NET CORE API with Angular 4 - The cookie token and the request token were swapped
body: <p>I keep getting this message when trying to implement XSRF with Angular and .NET CORE: "Validation of the provided antiforgery token failed. The cookie token and the request token were swapped."  I have the cookie and header names configured the same in both the Angular and API.  Anyone have any ideas?</p>
  
  <p><strong>Process</strong></p>
  
  <p>Angular makes an initial call to this API method to retrieve cookie</p>
  
  <pre><code>    [HttpGet("startSession")]
      public async Task&lt;IActionResult&gt; StartSession()
      {
          AntiforgeryTokenSet tokens = this.antiForgery.GetAndStoreTokens(this.HttpContext);
  
          this.HttpContext.Response.Cookies.Append(this.options.Value.Cookie.Name, tokens.RequestToken, new CookieOptions { HttpOnly = false });
  
          return this.Ok(
              new
              {
                  Success = true
              });
      }
  </code></pre>
  
  <p>Angular then intercepts the next POST request and overrides default XSRF handling slightly since I need it to work for HTTPS URLs</p>
  
  <pre><code>    // Override default Angular XSRF handling since it won't work for         
      absolute URLs and we have to prefix with "https://"
      // Source:https://github.com/angular/angular/blob/master/packages/common/http/src/xsrf.ts
      @Injectable()
      export class HchbHttpXsrfInterceptor implements HttpInterceptor {
      constructor(
      private tokenService: HttpXsrfTokenExtractor) {}
  
      intercept(req: HttpRequest&lt;any&gt;, next: HttpHandler): 
      Observable&lt;HttpEvent&lt;any&gt;&gt; {
      const headerName = 'X-XSRF-TOKEN';
      const lcUrl = req.url.toLowerCase();
      // Skip both non-mutating requests.
      // Non-mutating requests don't require a token
      // anyway as the cookie set
      // on our origin is not the same as the token expected by another origin.
      if (req.method === 'GET' || req.method === 'HEAD' ) {
           return next.handle(req);
      }
      const token = this.tokenService.getToken();
  
      // Be careful not to overwrite an existing header of the same name.
      if (token !== null &amp;&amp; !req.headers.has(headerName)) {
         req = req.clone({headers: req.headers.set(headerName, token)});
      }
      return next.handle(req);
      }
      }
  </code></pre>