Cool, thanks for the confirmation. Maybe we should extract "/admin" out
into a constant or just put a comment to make sure it's in sync with
web.xml.


On Fri, Oct 25, 2013 at 11:04 PM, oxtoacart <notifications@github.com>wrote:

> In src/main/java/org/lantern/admin/rest/CSRFProtectionFilter.java:
>
> > +
> > +    @Override
> > +    public void init(FilterConfig filterConfig) throws ServletException {
> > +    }
> > +
> > +    /**
> > +     * See http://docs.angularjs.org/api/ng.$http#description_security-considerations_cross-site-request-forgery-protection
> > +     */
> > +    @Override
> > +    public void doFilter(ServletRequest request, ServletResponse response,
> > +            FilterChain chain) throws IOException, ServletException {
> > +        HttpServletRequest req = (HttpServletRequest) request;
> > +        HttpServletResponse resp = (HttpServletResponse) response;
> > +        String tokenExpected = AdminServlet.getCsrfToken();
> > +        Cookie cookie = new Cookie("XSRF-TOKEN", tokenExpected);
> > +        cookie.setPath("/admin");
>
> We actually need to set the path, otherwise the cookie doesn't seem to
> work.
>
> We don't need to call setDomain, as the default is good.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/getlantern/lantern-controller/pull/46/files#r7232655>
> .
>