25 lines
937 B
Plaintext
25 lines
937 B
Plaintext
==============================================================================
|
|
docs/output/11-spa-ordering.txt
|
|
.csrf(c -> c.csrfTokenRepository(custom).spa()) - the custom repository asked for a cookie
|
|
named MY-CSRF and a header named X-CSRF-TOKEN. Neither reaches the running application.
|
|
Profile: spaorder
|
|
==============================================================================
|
|
|
|
HTTP/1.1 200
|
|
Vary: Origin
|
|
Vary: Access-Control-Request-Method
|
|
Vary: Access-Control-Request-Headers
|
|
Set-Cookie: XSRF-TOKEN=<token>; Path=/
|
|
X-Content-Type-Options: nosniff
|
|
X-XSS-Protection: 0
|
|
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
|
|
Pragma: no-cache
|
|
X-Frame-Options: DENY
|
|
|
|
# cookie jar:
|
|
|
|
localhost | FALSE | / | FALSE | 0 | XSRF-TOKEN | 42573eea-76d6-4bc6-a14b-bff76640461d
|
|
|
|
# spa() assigns csrfTokenRepository and requestHandler unconditionally; it is not a
|
|
# 'defaults if unset' method. Swap the two calls and MY-CSRF appears.
|