# Postman Interceptor retrieving CSRF-Token

**URL:** <https://community.postman.com/t/postman-interceptor-retrieving-csrf-token/36592>\
**Category:** Help Hub\
**Tags:** token\
**Created:** [June 27, 2022, 10:04am UTC](https://community.postman.com/t/postman-interceptor-retrieving-csrf-token/36592 "2022-06-27T10:04:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cekii](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@cekii](https://community.postman.com/u/cekii)\
**Post date:** [June 27, 2022, 10:04am UTC](https://community.postman.com/t/postman-interceptor-retrieving-csrf-token/36592/1 "2022-06-27T10:04:02Z")

</div>

I’m having a specific problem. I’m learning about Spring Security and one of the tasks is to retrieve csrf-token in Cookies section from GET request that I’m sending. Now guy from the video has exactly same code like I do I already checked that. CSRF is enabled, and he only enabled Postman Interceptor in top right corner(I assume it’s one of the older versions) bcs for me to activate Postman Interceptor I have to go in right bottom =\> Capture requests. I already went there and activate my Interceptor with Capturing Cookies checked/unchecked but no luck. What I’m only getting is SESSIONID in my cookies and that’s about it. Also I’m using basic auth with user and pw since csrf is enabled in order to perform my GET request. This is the screenshot on how it looks like on my screen: [Screenshot by Lightshot](https://prnt.sc/Bk3OU4QvIpPE)

I accept all kinds of help

---

<div class="post-metadata">

**Author:** ![joint-operations-en9](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@joint-operations-en9](https://community.postman.com/u/joint-operations-en9)\
**Post date:** [January 18, 2023, 11:41pm UTC](https://community.postman.com/t/postman-interceptor-retrieving-csrf-token/36592/2 "2023-01-18T23:41:52Z")

</div>

Hello. I am just wondering, did you ever solve this problem? I have the exact same problem now…

---

<div class="post-metadata">

**Author:** ![descent-module-pilo5](https://avatars.discourse-cdn.com/v4/letter/d/ed655f/32.png) [@descent-module-pilo5](https://community.postman.com/u/descent-module-pilo5)\
**Post date:** [July 4, 2024, 10:00am UTC](https://community.postman.com/t/postman-interceptor-retrieving-csrf-token/36592/3 "2024-07-04T10:00:43Z")

</div>

Yes, I have got it.  
I’m using spring security 6 and postman 11.2.  
In spring security 6 we have to use  
http.csrf(csrf → csrf.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()));  
and postman interceptor extension must be added.

http.csrf(csrf → csrf.disable()); won’t work here.

Thank you.