Try adding _csrf_token: "TRUE" in the routing requirements, like so,

requirements:
_csrf_token: 'TRUE'

You will also be required to auto generate the token from Drupal and use it in the request uri like so /ls/topdf?token=some auto generated token

Here is an example of how to auto generate a token from Drupal (I'm not sure if your Javascript runs on Java or on The Drupal app, but assuming it's from the Drupal app, you can pass the token from Drupal to your js);

$url = \Drupal\Core\Url::fromRoute('mymodule.to_pdf');
$token_service = Drupal::get('csrf_token')
$the_token = $token_service->get($url->getInternalPath());

Thus:

form.setAttribute('action', `/ls/topdf?token=${the_token from drupalSettings}`) ;

Another solution might be using an absolute path in the form action, using your current setup without changing anything about it.

And another would be to include an options key in your route definitions with parameters of an entity type user.

options:
  parameters:
    user:
      type: entity:user

`// update your controller method`
public function convertToPdf(AccountInterface $user, Request $request) {

and using that user entity to check for, is authenticated, has permissions and all, as your application requires.

Try adding _csrf_token: "TRUE" in the routing requirements, like so,

requirements:
_csrf_token: 'TRUE'

You will also be required to auto generate the token from Drupal and use it in the request uri like so /ls/topdf?token=some auto generated token

Here is an example of how to auto generate a token from Drupal (I'm not sure if your Javascript runs on Java or on The Drupal app, but assuming it's from the Drupal app, you can pass the token from Drupal to your js);

$url = \Drupal\Core\Url::fromRoute('mymodule.to_pdf');
$token_service = Drupal::service('csrf_token')
$the_token = $token_service->get($url->getInternalPath());

Thus:

form.setAttribute('action', `/ls/topdf?token=${the_token from drupalSettings}`) ;

Another solution might be using an absolute path in the form action, using your current setup without changing anything about it.

And another would be to include an options key in your route definitions with parameters of an entity type user.

options:
  parameters:
    user:
      type: entity:user

`// update your controller method`
public function convertToPdf(AccountInterface $user, Request $request) {

and using that user entity to check for, is authenticated, has permissions and all, as your application requires.

Try adding _csrf_token: "TRUE" in the routing requirements, like so,

requirements:
_csrf_token: 'TRUE'

You will also be required to auto generate the token from Drupal and use it in the request uri like so /ls/topdf?token=some auto generated token

Here is an example of how to auto generate a token from Drupal (I'm not sure if your Javascript runs on Java or on The Drupal app, but assuming it's from the Drupal app, you can pass the token from Drupal to your js);

$url = \Drupal\Core\Url::fromRoute('mymodule.to_pdf');
$token_service = Drupal::get('csrf_token')
$the_token = $token_service->get($url->getInternalPath());

Thus:

form.setAttribute('action', `/ls/topdf?token=${the_token from drupalSettings}`) ;

Try adding _csrf_token: "TRUE" in the routing requirements, like so,

requirements:
_csrf_token: 'TRUE'

You will also be required to auto generate the token from Drupal and use it in the request uri like so /ls/topdf?token=some auto generated token

Here is an example of how to auto generate a token from Drupal (I'm not sure if your Javascript runs on Java or on The Drupal app, but assuming it's from the Drupal app, you can pass the token from Drupal to your js);

$url = \Drupal\Core\Url::fromRoute('mymodule.to_pdf');
$token_service = Drupal::get('csrf_token')
$the_token = $token_service->get($url->getInternalPath());

Thus:

form.setAttribute('action', `/ls/topdf?token=${the_token from drupalSettings}`) ;

Another solution might be using an absolute path in the form action, using your current setup without changing anything about it.

And another would be to include an options key in your route definitions with parameters of an entity type user.

options:
  parameters:
    user:
      type: entity:user

`// update your controller method`
public function convertToPdf(AccountInterface $user, Request $request) {

and using that user entity to check for, is authenticated, has permissions and all, as your application requires.