00dani/lebd
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Remove unused CSRF-handling JS from the layout, we'll probably not be making AJAX requests here anyway

Browse source
This commit is contained in:
Danielle McLean 2017-10-05 07:49:58 +11:00
parent 69e3d7f267
commit d32b698545
Signed by: 00dani
GPG key ID: 5A5D2D1AFF12EEC5
2 changed files with 0 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/Foundation.hs
View file

@ -19,8 +19,6 @@ import Yesod.Auth.OpenId (authOpenId, IdentifierType (Claimed))
import Yesod.Default.Util (addStaticContentExternal)
import Yesod.Core.Types (Logger)
import qualified Yesod.Core.Unsafe as Unsafe
import qualified Data.CaseInsensitive as CI
import qualified Data.Text.Encoding as TE
-- | The foundation datatype for your application. This can be a good place to
-- keep settings and values requiring initialization before your application

18
templates/default-layout-wrapper.hamlet
View file

@ -15,24 +15,6 @@ $doctype 5
^{pageHead pc}
<script>
/* The `defaultCsrfMiddleware` Middleware added in Foundation.hs adds a CSRF token to the request cookies. */
/* AJAX requests should add that token to a header to be validated by the server. */
/* See the CSRF documentation in the Yesod.Core.Handler module of the yesod-core package for details. */
var csrfHeaderName = "#{TE.decodeUtf8 $ CI.foldedCase defaultCsrfHeaderName}";
var csrfCookieName = "#{TE.decodeUtf8 defaultCsrfCookieName}";
var csrfToken = Cookies.get(csrfCookieName);
if (csrfToken) {
\ $.ajaxPrefilter(function( options, originalOptions, jqXHR ) {
\ if (!options.crossDomain) {
\ jqXHR.setRequestHeader(csrfHeaderName, csrfToken);
\ }
\ });
}
<body>
^{pageBody pc}