{"action":"created","issue":{"url":"https://api.github.com/repos/mohiva/play-silhouette-angular-seed/issues/29","labels_url":"https://api.github.com/repos/mohiva/play-silhouette-angular-seed/issues/29/labels{/name}","comments_url":"https://api.github.com/repos/mohiva/play-silhouette-angular-seed/issues/29/comments","events_url":"https://api.github.com/repos/mohiva/play-silhouette-angular-seed/issues/29/events","html_url":"https://github.com/mohiva/play-silhouette-angular-seed/issues/29","id":104527475,"number":29,"title":"Csrf-Token","user":{"login":"Fours","id":3944076,"avatar_url":"https://avatars.githubusercontent.com/u/3944076?v=3","gravatar_id":"","url":"https://api.github.com/users/Fours","html_url":"https://github.com/Fours","followers_url":"https://api.github.com/users/Fours/followers","following_url":"https://api.github.com/users/Fours/following{/other_user}","gists_url":"https://api.github.com/users/Fours/gists{/gist_id}","starred_url":"https://api.github.com/users/Fours/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Fours/subscriptions","organizations_url":"https://api.github.com/users/Fours/orgs","repos_url":"https://api.github.com/users/Fours/repos","events_url":"https://api.github.com/users/Fours/events{/privacy}","received_events_url":"https://api.github.com/users/Fours/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-09-02T16:57:57Z","updated_at":"2015-09-02T19:11:04Z","closed_at":null,"body":"I'm curious why the csrf token is used by angular. Setting a csfr-token header value to \"nocheck\" would achieve the same amount of security against csfr attacks. So is the benefit of the token to simply future proof against possible vulnerabilities? Or is there another current vulnerability that it protects against?"},"comment":{"url":"https://api.github.com/repos/mohiva/play-silhouette-angular-seed/issues/comments/137216821","html_url":"https://github.com/mohiva/play-silhouette-angular-seed/issues/29#issuecomment-137216821","issue_url":"https://api.github.com/repos/mohiva/play-silhouette-angular-seed/issues/29","id":137216821,"user":{"login":"akkie","id":307006,"avatar_url":"https://avatars.githubusercontent.com/u/307006?v=3","gravatar_id":"","url":"https://api.github.com/users/akkie","html_url":"https://github.com/akkie","followers_url":"https://api.github.com/users/akkie/followers","following_url":"https://api.github.com/users/akkie/following{/other_user}","gists_url":"https://api.github.com/users/akkie/gists{/gist_id}","starred_url":"https://api.github.com/users/akkie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/akkie/subscriptions","organizations_url":"https://api.github.com/users/akkie/orgs","repos_url":"https://api.github.com/users/akkie/repos","events_url":"https://api.github.com/users/akkie/events{/privacy}","received_events_url":"https://api.github.com/users/akkie/received_events","type":"User","site_admin":false},"created_at":"2015-09-02T19:11:03Z","updated_at":"2015-09-02T19:11:03Z","body":"It's an example which shows how the token can be implemented on the Play and the Angular side and I think it provides the most secure way now and in the future. \r\n\r\n> Also have a similar question for why \"application/json\" is included in the csfr blacklist. Thanks.\r\n\r\nIn this example forms are submitted via Json so it's needed to check for the CSFR token."}}