Implement CSRF protection for REST interface (fixes #287)

2014-06-04 21:20:07 +02:00
parent 028e9bc17a
commit 80c2b32b92
4 changed files with 120 additions and 1 deletions
--- a/gui/app.js
+++ b/gui/app.js
@@ -10,6 +10,11 @@
 var syncthing = angular.module('syncthing', []);
 var urlbase = 'rest';

+syncthing.config(function ($httpProvider) {
+    $httpProvider.defaults.xsrfHeaderName = 'X-CSRF-Token';
+    $httpProvider.defaults.xsrfCookieName = 'CSRF-Token';
+});
+
 syncthing.controller('SyncthingCtrl', function ($scope, $http) {
    var prevDate = 0;
    var getOK = true;