| Subject: | CSRF protection in AJAX. |
Hi, Yuki. I like your plugin. And it will be great also to have
protection in ajax for 'PUT', 'POST', 'DELETE' methods like in Ruby on
Rails.
For example, you can add helper like <% =csrf_protection_for_jquery_ajax
%> which will insert some code like this(I have not tested it):
From rails.js:
// Make sure that every Ajax request sends the CSRF token
function CSRFProtection(xhr) {
var token = $('meta[name="csrf-
token"]').attr('content');
if (token) xhr.setRequestHeader('X-CSRF-Token', token);
}
if ('ajaxPrefilter' in $) $.ajaxPrefilter(function(options,
originalOptions, xhr){ CSRFProtection(xhr) });
else $(document).ajaxSend(function(e, xhr){ CSRFProtection(xhr)
});
==========================================
Or this (found in Internet):
$.ajaxSetup({
beforeSend: function(xhr) {
xhr.setRequestHeader('X-CSRF-Token', $('meta[name="csrf-
token"]').attr('content'));
}
});
=========================================