I tested your example with Postman. Unfortunately I got a 403-forbidden despite X-CSRF token in the header. It's because of two different tokens in crumb:
This thread has been automatically locked due to inactivity. Please open a new issue for related bugs or questions following the new issue template instructions.
I tested your example with Postman. Unfortunately I got a 403-forbidden despite X-CSRF token in the header. It's because of two different tokens in crumb: