NancyFx/Nancy — Issue #428: Opt out of sending CSRF cookie
Author: nolanw
Created: 2011-12-01 17:41:11+00:00
State: open

I'd like to be able to not send the NCSRF cookie. I'm implementing CSRF protection without using cookies, and it's a nuisance to have the `Set-Cookie` header on every response. I'm not worried about (non-existent) performance implications, and I understand that clients can use my web service by simply ignoring the cookie. Nonetheless, I'd like to stop sending it.

I can't remove the cookie in a module because it gets added at the end of the After pipeline, and my module's After can't reach that far. Even adding my own Startup that clears response cookies doesn't work. None of this is surprising, but I'm out of ideas for how to disable the cookie short of stripping the CSRF stuff out of Nancy.

I love how Nancy avoids configuration files, and I'd like to see it stay that way, so I'm not too sure how to approach this. If anyone can point me in the right direction, I'd be more than happy to attach some code that gets this done.