Q:

jquery post method doesn't work (403 - Forbidden)

$.get() works in my codes but $.post() doesn't.  With same codes...
When I use $.post() my codes can't reach to Controller. 
I'm using MVC(Sails.js).  Almost I read every issue and document.  But I can't find any reason.  
html
<div id="login-form-panel" class="form-login">   
    <form id="login-form" role="form">
        <legend><h1>Login in..</h1></legend>

        <input type="text" id="username" placeholder="User name" data-clear-btn="true" autocomplete="off" title="User name" autofocus required />

        <input type="password" id="password" placeholder="Password" data-clear-btn="true" autocomplete="off" title="Password" required />

        <input type="submit" id="btn-form-login" class="btn btn-primary  btn-lg btn-block" style="margin-top:17px" value="Login">
    </form>  
</div>

js
   // $('body').on('click', '#btn-form-login', function() {
   $("#login-form").submit(function(e){
        username = $("#username").val();
        password = $("#password").val();

        if(!console) {
            console = {};
            console.log = function() {};
        }
        console.log(username + " " + password);

            $.post(
                '/user/login',
                { username: username, password: password },
                function(res) {
                    $.session.set('username', username);
                    $.session.set('password', password);
                    window.location = res;
                },
                "json"
            )
            .fail(function(xhr, statusText, error){ 
                alert(xhr.status);
            });

            e.preventDefault();

    });

controller
module.exports = {

    login: function(req, res) {

        console.log("controller works..");

        // To use mongo native query 
        User.native(function(err, collectionUser) {

            if(err) { return err; };
            if(!collectionUser) { return err; };

            collectionUser
            .find({'username' : req.param('username')})
            .nextObject(function (err, user) {

                if(err) { 
                    console.log('db error');
                    res.send(500, 'db error');
                    return err; 
                };

                if(!user) {
                    console.log('username error');
                    res.send(404, { error: 'username error'});
                };

                if(user) { 
                    if(user.password === req.param('password')) {

                        // Log user in
                        req.session.authenticated = true;
                        req.session. User = user;

                        var oldDateObj = new Date();
                        var newDateObj = new Date(oldDateObj.getTime() + 3600000);
                        req.session.cookie.expires = newDateObj;

                        user.online = true;

                        collectionUser.save(user, {w: 1}, function(err, user_id) {

                            if(err) {
                                res.send(500, 'There is an error when accessing db\n' + err);
                            }

                            // Inform other sockets
                            User.publishUpdate(user_id, {
                                loggedIn: true,
                                id: user._id,
                                name: user.username,
                                action: ' giriş yaptı.' 
                            });

                            res.send("/user/show/" + user['_id']);                        
                        });

                    } else { 
                        console.log('password error'); 
                        res.send(400, 'password error');
                        //res.redirect('/'); 
                    } 

                };

            });
        });
    },
}

A:

Solution
1- Configure the Sails' Cross-Site Request Protection to use POST method - as Zieaglar's said above.  Thus;
Firstly go to config/csrf.js and change the boolean value to false.  And
secondly add the following codes into your form tag
<input type='hidden' name='_csrf' value='<%= _csrf %>'>

2- Remove dataType section in POST methed - "json"

