My problem is that I cannot submit data to my controller from JS widget because it is "missing" a csfr token. But I've tried having a hidden field for the token and getting it from web.core. Nothing works!

Error in log:

 odoo URLs are CSRF-protected by default (when accessed with unsafe HTTP methods).

JS:

var formData = new FormData();
form.find('input').each(function() {
	var el = $(this);
	formData.append(el.attr('name'), el.val())

});
formData.append('csrf_token', core.csrf_token);
console.log(Object.fromEntries(formData));
$.ajax({
	url: '/some-url/add',
	data: formData,
	processData: false,
	contentType: false,
	type: 'POST',
	success: function (data) {
		console.log('Submission was successful.');
		console.log(data);
	},
	error: function (data) {
		console.log('An error occurred.');
		console.log(data);
	},
});

Py:

@http.route(['/some-url/add'], type='http', auth="public", method=['POST'])

What I'm doing wrong?