The POST action seems to have no effect on the .net core controller.

If you put [IgnoreAntiforgeryToken] attribute on the server controller method, it works. But dont' leave it like that exposing vulnerability.

Turns out, Angular uses a particular header name "X-XSRF-TOKEN" to store token for the server to accept: 

The following client code snippet in the Angular 6 component works. It's just part of . Only to note the headers line.

const event: UploadInput = {type: 'uploadAll',url: this.UPLOAD_API_URL + '?guid=' + this.guid,method: 'POST',headers: {
      'X-XSRF-TOKEN': this._cookieService.get("XSRF-TOKEN")},withCredentials: true,data: { foo: 'bar' }};

_cookieService is an injected service using . You may use any cookie tool.