gered/clj-browserchannel
Archived
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

update chat-demo to use an anti-forgery token to demo how to set it up

Browse source
This commit is contained in:
Gered 2016-05-08 17:59:31 -04:00
parent c18f295018
commit a58f6934c7
2 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
chat-demo/resources/html/index.html
View file

@ -3,6 +3,11 @@
<head> <head>
<meta charset="UTF-8"/> <meta charset="UTF-8"/>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<!-- include CSRF token that ring's anti-forgery middleware is expecting.
clj-browserchannel's client-side init will pick this meta tag up
automatically and include the token in all of browserchannel's
requests to the server. -->
<meta name="anti-forgery-token" content="{{ csrfToken }}">
<title>BrowserChannel</title> <title>BrowserChannel</title>
<!-- Le HTML5 shim, for IE6-8 support of HTML elements --> <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->
<!--[if lt IE 9]> <!--[if lt IE 9]>

8
chat-demo/src/chat_demo/server.clj
View file

@ -5,6 +5,7 @@
[compojure.route :as route] [compojure.route :as route]
[ring.middleware.defaults :refer [wrap-defaults site-defaults]] [ring.middleware.defaults :refer [wrap-defaults site-defaults]]
[ring.util.response :refer [response]] [ring.util.response :refer [response]]
[ring.middleware.anti-forgery :refer [*anti-forgery-token*]]
[clj-pebble.core :as pebble] [clj-pebble.core :as pebble]
[net.thegeez.browserchannel.server :as browserchannel] [net.thegeez.browserchannel.server :as browserchannel]
[net.thegeez.browserchannel.jetty-async-adapter :as jetty] [net.thegeez.browserchannel.jetty-async-adapter :as jetty]
@ -40,14 +41,17 @@
(def app-routes (def app-routes
(routes (routes
(GET "/" [] (pebble/render-resource "html/index.html" {:dev (boolean (env :dev))})) (GET "/" [] (pebble/render-resource
"html/index.html"
{:dev (boolean (env :dev))
:csrfToken *anti-forgery-token*}))
(route/resources "/") (route/resources "/")
(route/not-found "not found"))) (route/not-found "not found")))
(def handler (def handler
(-> app-routes (-> app-routes
(browserchannel/wrap-browserchannel {:base "/channel" :on-session on-browserchannel-session}) (browserchannel/wrap-browserchannel {:base "/channel" :on-session on-browserchannel-session})
(wrap-defaults (assoc-in site-defaults [:security :anti-forgery] false)))) (wrap-defaults site-defaults)))
(defn run-jetty [] (defn run-jetty []
(println "Using Jetty adapter") (println "Using Jetty adapter")