Skip to content

/ sente

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Example fails if first url exists in resources #318

Closed
jacovig opened this issue Jan 12, 2018 · 4 comments
Closed

Example fails if first url exists in resources #318

jacovig opened this issue Jan 12, 2018 · 4 comments
Labels
pull requests welcome

Comments

@jacovig
Copy link

@jacovig jacovig commented Jan 12, 2018

When your first url (e.g. /index.html) exists in resources, no csrf token is ever transmitted. Seems to be due to wrap-resources taking place before wrap-anti-forgery in wrap-default and so stealing the request, that does not get anti-forgery. Changing order (first anti-forgery, next wrap-resources) works like a charm.
@ptaoussanis
Copy link
Owner

@ptaoussanis ptaoussanis commented Jan 13, 2018

Thanks for the report, PR welcome!
@timothypratley
Copy link
Collaborator

@timothypratley timothypratley commented May 11, 2018

This issue seems to be with ring-defaults more than sente... ?
I don't see a way Sente can get a csrf with the current ring wrap-defaults site-defaults behavior, so custom middleware wrapping is required.
This seems like a really bad default for ring; I'll try to raise an issue on ring-defaults.
@timothypratley timothypratley mentioned this issue May 11, 2018
Closed
@timothypratley
Copy link
Collaborator

@timothypratley timothypratley commented May 11, 2018

ring-clojure/ring-defaults#23
This was referenced May 11, 2018
Open
Closed
@timothypratley
Copy link
Collaborator

@timothypratley timothypratley commented Jun 1, 2018

Ring now puts anti-forgery in the request (for ring-defaults 0.3.2+)
#323
^^ this small change looks for the token and uses it if available, and resolves the Sente issue.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
pull requests welcome
Projects
None yet
Milestone
No milestone
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
3 participants
@timothypratley @ptaoussanis @jacovig
You can’t perform that action at this time.