# \[Cakephp 4\]Fetch API send CSRF give me 400 error

**URL:** <https://discourse.cakephp.org/t/cakephp-4-fetch-api-send-csrf-give-me-400-error/8051>\
**Category:** Need Help\
**Created:** [July 13, 2020, 9:44am UTC](https://discourse.cakephp.org/t/cakephp-4-fetch-api-send-csrf-give-me-400-error/8051 "2020-07-13T09:44:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![christ57](https://avatars.discourse-cdn.com/v4/letter/c/b4bc9f/32.png) [@christ57](https://discourse.cakephp.org/u/christ57)\
**Post date:** [July 13, 2020, 9:44am UTC](https://discourse.cakephp.org/t/cakephp-4-fetch-api-send-csrf-give-me-400-error/8051/1 "2020-07-13T09:44:37Z")

</div>

Hello,

I am trying to send a POST request to my controller (without form). For that, I use fetch API with this code :  
var data = {  
“action”: e.target.getAttribute(‘data\_action’),  
“username”: e.target.getAttribute(‘data\_username’)  
}  
let response = fetch(’/website/follow/request’, {  
headers: {  
“X-Requested-With”: “XMLHttpRequest”,  
“X-CSRF-Token”: csrfToken  
},  
method: “POST”,  
credentials: “same-origin”,  
body: JSON.stringify(data)  
})  
.then(function(response) {  
return response.text();  
})  
.then(function(Data) {}  
}

Following the DOC,the token is defined like this

```
echo $this->Html->scriptBlock(sprintf(
'var csrfToken = %s;',
json_encode($this->request->getAttribute('csrfToken'))

```

));

After sending my request, i GET an error 400 with ‘\_Token’ was not found in request data.

If I look at the header of the request sent through the browser, I can see that the csrf is sent

How can I correctly send the token to the controller to make my request ?

Thanks

---

<div class="post-metadata">

**Author:** ![markstory](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/markstory/32/182_2.png) [@markstory](https://discourse.cakephp.org/u/markstory)\
**Post date:** [July 14, 2020, 2:02am UTC](https://discourse.cakephp.org/t/cakephp-4-fetch-api-send-csrf-give-me-400-error/8051/2 "2020-07-14T02:02:40Z")

</div>

The `_Token` field is used by SecurityComponent/FormProtectionComponent and not CSRF. If you have either of those components active and want to submit requests via fetch() you’re going to have a hard time. Both of these components hash the fields & and hidden input values in a form and require that hash to be present when processing POST data. You’ll either need to extract that data out of the HTML form created with FormHelper, or disable those components for the actions you want to submit data to via fetch().