Unable to set XSRF token without workaround

Hi,

me and @symrad were working on a problem using Fusty on IE9 on an application that requires XSRF protection. I know that this topic has been already dealt with in #5 and we agree that headers are not the proper way to set the token.

But let me go by steps. I would like to understand if our code is broken or there is a bug in Fusty.

Originally we used the following code in Angular to initialize fusty

angular.module('pnx')
.config([ '$compileProvider', 'PnxAppConfigConstant', '$locationProvider', '$httpProvider', '$provide', 'flowFactoryProvider', AppConfig ]);

function fustyFlowFactory(opts) {
    var flow = new Flow(opts);

    if (flow.support) {
        return flow;
    }

    return new FustyFlow(opts);
}

function AppConfig($compileProvider, PnxAppConfigConstant, $locationProvider, $httpProvider, $provide, flowFactoryProvider) {

    flowFactoryProvider.factory = fustyFlowFactory;
    flowFactoryProvider.defaults = {
        permanentErrors : [ 404, 500, 501 ],
        testChunks : false,
        chunkSize : 9007199254740992,
        headers : function(file, chunk, isTest) {
            var headers = {};
            headers[PnxAppConfigConstant.getCsrf().header] = PnxAppConfigConstant.getCsrf().csrf;
            return headers;
        },
        query : function(file, chunk, isTest) {
            var postParams = {};
            postParams._csrf = PnxAppConfigConstant.getCsrf().csrf;
            return postParams;
        }
    };

    // [...] other stuff for our app
}

Explanation:

fustyFlowFactory function instantiates Fusty Flow if Flow is not supported by the browser (hits the branch in IE9 as expected)
fustyFactoryProvider.defaults sets both the headers (successfully used by Flow on Firefox/Chrome) and the query (supposed to be used by Fusty)

However the above code didn't work. Fusty never got the defaults. Even debugging the code at https://github.com/flowjs/fusty-flow.js/blob/master/src/fusty-flow.js#L55, it never read the defaults from the factory.

So we had to change the code and force the token into the query.

Current code

function AppConfig($compileProvider, PnxAppConfigConstant, $locationProvider, $httpProvider, $provide, flowFactoryProvider) {

    var factoryFunc = function(opts) {
        var flow = new Flow(opts);

        if (flow.support)
            return flow;

        opts.query._csrf = PnxAppConfigConstant.getCsrf().csrf;
        return new FustyFlow(opts);
    };

    flowFactoryProvider.factory = factoryFunc;
    flowFactoryProvider.defaults = {
        permanentErrors : [ 404, 500, 501 ],
        testChunks : false,
        chunkSize : 9007199254740992,
        headers : function(file, chunk, isTest) {
            var headers = {};
            headers[PnxAppConfigConstant.getCsrf().header] = PnxAppConfigConstant.getCsrf().csrf;
            return headers;
        },
        query : function(file, chunk, isTest) {
            var postParams = {};
            postParams._csrf = PnxAppConfigConstant.getCsrf().csrf;
            return postParams;
        }
    };

This time we explicitly set token in the options. Works just fine. I can see the token in the request and get to upload

I would like to open this issue as a potential bug, because IMO Fusty should read the defaults from the flow factory as Flow would do normally. I haven't dug enough in the code to confirm it's a bug, but I start from the assumption that factory settings should also work on Fusty and not only on classic Flow.

What do you think about it?

flowjs / fusty-flow.js

Unable to set XSRF token without workaround #16