csurf

client.js

exports.post = (urlPath,  postData, callback) => {
    axios.post(urlPath, qs.stringify(postData),{
        headers: {'X-Requested-With': 'XMLHttpRequest'},
        xsrfCookieName:'csrftoken',
        xsrfHeaderName:'csrf-token',
        data:postData
    })
      .then(function (response) {
        callback(response)
      })
      .catch(function (error) {
        if (error.response) {
            callback(error.response.data)
        }
      });
}

server

    const csrfProtection = csurf({ cookie: true })
    const csrfSetHeader = (req, res, next) => {
      res.header('csrf-token', req.csrfToken())
      res.header('Access-Control-Allow-Origin', '*')
      next()
    }
    server.post("/auth/register",csrfProtection, Auth.register)