フロントエンドはサービス開発リファレンスを使って、バックエンドは自前で作成してみた

$ mvn spring-boot:run

server.port=9080
server.servlet.context-path=/api

package com.example.controller;

import org.springframework.web.bind.annotation.*;

import java.util.List;

@RestController
@RequestMapping("/todos")
public class TodosController {

    @GetMapping
    public List<TodoResponse> get() {
        // 疎通の検証が目的のため、固定で返却する
        return List.of(
                new TodoResponse(1L, "やること１"),
                new TodoResponse(2L, "やること２"),
                new TodoResponse(3L, "やること３"));
    }

    @PostMapping
    public TodoResponse post(@RequestBody PostRequest requestBody) {
        // 疎通を検証が目的のため、入力値の検証はせず、IDは固定で返却する
        return new TodoResponse(4L, requestBody.text);
    }

    public static class PostRequest {

        public String text;
    }

    public static class TodoResponse {

        public final Long id;

        public final String text;

        public TodoResponse(Long id, String text) {
            this.id = id;
            this.text = text;
        }
    }
}

package com.example;

import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;

import java.util.List;

import static org.springframework.security.config.Customizer.withDefaults;

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors(withDefaults());
    }

    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(List.of("http://localhost:3000"));
        configuration.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "PATCH"));
        configuration.setAllowedHeaders(List.of("Content-Type", "X-CSRF-TOKEN"));
        configuration.setAllowCredentials(true);

        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);

        return source;
    }
}

package com.example.controller;

import org.springframework.security.web.csrf.CsrfToken;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class CsrfController {

    @GetMapping("/csrf_token")
    public CsrfToken csrf(CsrfToken token) {
        return token;
    }
}

$ mvn spring-boot:run

function refreshCsrfToken(): Promise<void> {
  Logger.debug('call service of refreshCsrfToken');

  return getCsrfToken().then(({ headerName, token}) => {
    Logger.debug('headerName:', headerName, 'token:', token);
    restClient.csrfTokenHeaderName = headerName;
    restClient.csrfTokenValue = token;
  });
}