Addind POST value for CSRF security

[anaximandre]

Hi,

JTable is really great, thank you for the work.

I would like to use JTable in a context where the server side (Django) is requesting a value systematically in all POST for security reasons. Thus I would like to have a default csrfmiddlewaretoken : csrftokenValue to be added to each POST.

I don't see the possibility to add defaut params in POSTs in the doc. Is there an easy way to do that ?

Thx for you help Di

[chc88]

http://www.jtable.org/ApiReference#fopt-input create your own field '<input type="hidden" ....'

[anaximandre]

Hi,

Thx a lot for your answer, it worked :)

Kind regards Di

[tibotiber]

This only works for create and edit actions. You can also pass it directly in the action urls:

actions: {
    listAction:   '/whatever/list?_csrf='+_csrf,
    createAction: '/whatever/create?_csrf='+_csrf,
    updateAction: '/whatever/update?_csrf='+_csrf,
    deleteAction: '/whatever/destroy?_csrf='+_csrf
}

[albertojm]

Hi everyone, I'm having the same issue with Laravel 5. But only when deleting. my source looks like:

$('#jtable').jtable({
    toolbar: {
        items: [{
            text: $('#SearchContainer')
        }]
    },
    title: 'Items',
    actions: {
        listAction: '/admin/suppliers/list/',
        deleteAction: '/admin/products/destroy/'
    },
    fields: {
        id: {
            key: true,
            list: false
        },        
        CustomEdit: {
            sorting: false,
            display: function (data) {
                return '<a href="'+ data.record.id +'/edit/"><i class="fa fa-edit"></a>';
            }
        },
        token: {
            list: false,
            display: function (data) {
                return '<input type="hidden" name="_token" value="'+_csrf+'" />';
            }
        }
    }
});

$('#jtable').jtable('load', { '_token': $('#extra').val() }); 

Everything works fine on listAction, but deleting fails. How can I pass the csrf token when deleting? Sadly @tibotiber solution doesn't work for me since Laravel destroy method is POST based (on a resource group).

Kind regards, Alberto.