3280ff6ac5
This change adds support for retrieving an antiforgery CSRF token via a configurable header in addition to the form field. This helps with doing ajax requests in a 1st-party SPA when using cookie auth, and is similar to functionality provided by a bunch of different frameworks. In this change there's also a bunch of churn due to avoiding the term 'form' in favor of 'request' and 'session' in favor of 'cookie'. Where code and error message now mention 'form' they specifically mean form-encoded content. |
||
|---|---|---|
| .. | ||
| AntiforgeryOptionsSetupTest.cs | ||
| AntiforgeryTokenTest.cs | ||
| BinaryBlobTest.cs | ||
| DefaultAntiforgeryTest.cs | ||
| DefaultAntiforgeryTokenGeneratorTest.cs | ||
| DefaultAntiforgeryTokenSerializerTest.cs | ||
| DefaultAntiforgeryTokenStoreTest.cs | ||
| DefaultClaimUidExtractorTest.cs | ||
| Microsoft.AspNet.Antiforgery.Test.xproj | ||
| TestOptionsManager.cs | ||
| project.json | ||