Closed giovannicandido closed 1 year ago
Yes it should, and what you suggest is the way to go. It is a regression introduced with 6.1.6
.
@giovannicandido, off course, I can fix this and publish a new version within an hour, but I think you should get the credits. Please let me know if you are OK to send a PR.
@ch4mpy Yes I can send a PR.
@giovannicandido fix released in 6.1.9
. Thanks again for spotting and fixing that.
Enabling csrf for angular application with the config:
com.c4-soft.springaddons.security.client.csrf=cookie_accessible_from_js com.c4-soft.springaddons.security.csrf=cookie_accessible_from_js The cookie is sill only accessible by http:
XSRF-TOKEN=805f84f7-8c2a-4cb2-9c66-97072324090e; Path=/api; HttpOnly
Code sample The code in ServletConfigurationSupport::
Maybe should be like the test class AddonsWebmvcTestConfig
Expected behavior
The token is not set to httpOnly