denisstepanenko/nci-aria-project — pull request #50 by donaldevine (2014-04-16 12:24:09+00:00)
Title: Anti Cross-site request forgery (XSRF) stuff

Set XSRF-TOKEN cookie and added CheckXrfHeaderAttribute attribute to Web API base controller to check HTTP requests for XSRF token.

By creating a cookie named XSRF-TOKEN Angular will automatically include this in the HTTP header - we do not need to do anything - Angular handles this automatically!!!

From the Angular docs:
Your server needs to set a token in a JavaScript readable session cookie called XSRF-TOKEN on the first HTTP GET request.
On subsequent XHR requests the server can verify that the cookie matches X-XSRF-TOKEN HTTP header, and therefore be sure that only JavaScript running on your domain could have sent the request.
The token must be unique for each user and must be verifiable by the server (to prevent the JavaScript from making up its own tokens).
We recommend that the token is a digest of your site's authentication cookie with a salt) for added security.