Shopify/batman — Issue #276: Find a great way to handle CSRF token (in Rails at least)
Author: jipiboily
Created: 2011-12-10 02:40:22+00:00
State: open

I can add those two lines in batman.jquery.coffee:

token = $("meta[name=\"csrf-token\"]").attr("content")
xhr.setRequestHeader "X-CSRF-Token", token if token

It would look like:

beforeSend: (xhr)=>
token = $("meta[name=\"csrf-token\"]").attr("content")
xhr.setRequestHeader "X-CSRF-Token", token if token
@fire 'loading'

Once compiled:

beforeSend: __bind(function(xhr) {
var token = $('meta[name="csrf-token"]').attr('content');
if (token) xhr.setRequestHeader('X-CSRF-Token', token);
return this.fire('loading');
}, this),

Disclaimer: [code taken backbone](https://github.com/codebrew/backbone-rails/blob/master/vendor/assets/javascripts/backbone_rails_sync.js#L26-27)

How would you do it cleanly? How would you test that?