[GitHub] verdan commented on a change in pull request #3804: [AIRFLOW-2866] Fix missing CSRF token header when using RBAC UI

[GitBox <gi...@apache.org>]

verdan commented on a change in pull request #3804: [AIRFLOW-2866] Fix missing CSRF token header when using RBAC UI
URL: https://github.com/apache/incubator-airflow/pull/3804#discussion_r213296428
 
 

 ##########
 File path: airflow/www_rbac/templates/appbuilder/baselayout.html
 ##########
 @@ -70,6 +70,13 @@
   // below variables are used in clock.js
   var hostName = '{{ hostname }}';
   var csrfToken = '{{ csrf_token() }}';
+  $.ajaxSetup({
+    beforeSend: function(xhr, settings) {
+      if (!/^(GET|HEAD|OPTIONS|TRACE)$/i.test(settings.type) && !this.crossDomain) {
+        xhr.setRequestHeader("X-CSRFToken", "{{ csrf_token() }}");
 
 Review comment:
   @gsilk can you please use the `csrfToken` variable that is declared above instead of  calling the `csrf_token()` again?

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services