nextcloud-server-mirror/core/js/oc-requesttoken.js at 845fd2dd5a8700131494de8c7ebc66ebef097821 - nextcloud-server-mirror - Gitea: Git with a cup of tea

averello/nextcloud-server-mirror

mirror of https://github.com/nextcloud/server.git synced 2026-06-29 12:24:50 +02:00

Files

T

Lukas Reschke cd90685af1 Do not add sensitive request headers for cross domain requests

Prevents leaking the CSRF token to another third-party domain by mistake.

2015-09-15 11:42:13 +02:00

7 lines

209 B

JavaScript

Raw Blame History

 $(document).on('ajaxSend',function(elm, xhr, settings) {
 	if(settings.crossDomain === false) {
 		xhr.setRequestHeader('requesttoken', oc_requesttoken);
 		xhr.setRequestHeader('OCS-APIREQUEST', 'true');
 	}
 });