Skip to content
This repository was archived by the owner on Apr 12, 2024. It is now read-only.

docs($http): reword of XSRF attack overview #13901

Closed
wants to merge 1 commit into from
Closed

docs($http): reword of XSRF attack overview #13901

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions src/ng/http.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -749,8 +749,9 @@ function $HttpProvider() {
*
* ### Cross Site Request Forgery (XSRF) Protection
*
* [XSRF](http://en.wikipedia.org/wiki/Cross-site_request_forgery) is a technique by which
* an unauthorized site can gain your user's private data. Angular provides a mechanism
* [XSRF](http://en.wikipedia.org/wiki/Cross-site_request_forgery) is an attack technique by which
* a malicious site can issue requests to your server as if they were coming from JavaScript
* running on your domain. Angular provides a mechanism
* to counter XSRF. When performing XHR requests, the $http service reads a token from a cookie
* (by default, `XSRF-TOKEN`) and sets it as an HTTP header (`X-XSRF-TOKEN`). Since only
* JavaScript that runs on your domain could read the cookie, your server can be assured that
Expand Down