Fixing xsrf header on missing xsrfCookieName #406
Conversation
| @@ -28,6 +28,19 @@ describe('xsrf', function () { | |||
| }); | |||
| }); | |||
|
|
|||
| it('should not set xsrf header if xsrfCookieName is null', function (done) { | |||
There was a problem hiding this comment.
Maybe you should include a test to check that document.cookie isn't read if xsrfCookieName is null, as it's the main motivation of this PR. We can only do that using ES5 getters and we haven't used them in any test (nor the production code). It will work in the test runners but we claim to support IE8+ for the production code, so I'm not entirely sure it's a good idea. What do you think @mzabriskie @nickuraltsev ?
There was a problem hiding this comment.
I think we can make an assumption that the adapter doesn't access document.cookie directly, but rather uses the cookies helper. It's seems to be much easier to spy on a function than on a property with Jasmine.
There was a problem hiding this comment.
I agree. @pracucci, can you add that test?
This change introduce a way to disable cookies reading and fix #395.