ngocdaothanh/xitrum — pull request #235 by caiiiycuk (2013-11-16 06:11:27+00:00)
Title: X-csrf-token

Now csrf-token passed only in body params. I add lookup in request headers. For perfomance reason some time post body contains huge raw binary data, and adding csrf-token to body is not possible. In this case csrf token can be sended throught ```X-csrf-token``` request header. Client side example:

```coffeescript
array = new Uint8Array(contents);

$.ajax
url: '/xhr/save/push'
type: 'POST'
data: array
processData: false
contentType: 'application/octet-stream'
beforeSend: (request) ->
request.setRequestHeader('X-Profile', JSON.stringify(Epicport['profile']))
request.setRequestHeader('X-csrf-token', $("meta[name='csrf-token']").attr("content"))
success: (resp) ->
Epicport.modalMessage("Success", "Game saved on server")
error: (xhr, state, error) ->
status = xhr.status || 500
error = error || "Unknown error"

Epicport.modalMessage("Error (" + status+ ")", "(" + status + "): " + error)
```