[Dojo-interest] Upload file via dojo.io.iframe.send() with CSRF secret token

[andrew.ortwein]

My current project has a requirement that all requests contain a secret token
in the header in order to prevent cross-site request forgery (CSRF).
Unfortunately, it appears that you cannot set headers when using
dojo.io.iframe.send() to upload a file. Does anyone know of a way around
this?

I've searched quite a bit and it appears that there is no way to include
headers in dojo.io.iframe.send(). Is there any other way to upload files
and include headers in the request? If not, does anyone have any other
ideas? I'm a bit surprised that this inability to protect against CSRF when
uploading files hasn't come up before.

As always, thanks for any help you can provide!

[Kris Zyp]

This isn't just a Dojo limitation, it is a browser limitation.
Browser's don't allow headers to be set on form-triggered requests.
Put your CSRF secret token in the request query parameters (in the URL).
Kris

Post by andrew.ortwein
My current project has a requirement that all requests contain a
secret token in the header in order to prevent cross-site request
forgery (CSRF). Unfortunately, it appears that you cannot set
headers when using dojo.io.iframe.send() to upload a file. Does
anyone know of a way around this?
I've searched quite a bit and it appears that there is no way to
include headers in dojo.io.iframe.send(). Is there any other way
to upload files and include headers in the request? If not, does
anyone have any other ideas? I'm a bit surprised that this
inability to protect against CSRF when uploading files hasn't come
up before.
As always, thanks for any help you can provide!

- --
Kris Zyp
SitePen
[phone]
http://sitepen.com

[andrew.ortwein]

Thanks, Kris! This is exactly the kind of response I was looking for. I had
a feeling that since I wasn't able to find an answer anywhere, I was really
asking the wrong question.

[andrew.ortwein]

Thanks, Kris! This is exactly the kind of response I was looking for. I had
a feeling that since I wasn't able to find an answer anywhere, I was really
asking the wrong question.