{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Antiforgery/issues/125","repository_url":"https://api.github.com/repos/aspnet/Antiforgery","labels_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/125/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/125/comments","events_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/125/events","html_url":"https://github.com/aspnet/Antiforgery/issues/125","id":210203391,"number":125,"title":"Configurable HttpOnly Cookie","user":{"login":"itanex","id":430586,"avatar_url":"https://avatars1.githubusercontent.com/u/430586?v=3","gravatar_id":"","url":"https://api.github.com/users/itanex","html_url":"https://github.com/itanex","followers_url":"https://api.github.com/users/itanex/followers","following_url":"https://api.github.com/users/itanex/following{/other_user}","gists_url":"https://api.github.com/users/itanex/gists{/gist_id}","starred_url":"https://api.github.com/users/itanex/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/itanex/subscriptions","organizations_url":"https://api.github.com/users/itanex/orgs","repos_url":"https://api.github.com/users/itanex/repos","events_url":"https://api.github.com/users/itanex/events{/privacy}","received_events_url":"https://api.github.com/users/itanex/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-02-25T02:24:35Z","updated_at":"2017-03-01T23:23:46Z","closed_at":null,"body":"### Configurable HttpOnly Cookie\r\nAllow API user to Configure if the cookie generated is HttpOnly or not\r\n\r\n### Functional impact\r\n* Allows for use of ValidationToken Facilities in Angular and other frameworks\r\n* Changes Hard coded true value to an optional value\r\n\r\n### Minimal repro steps\r\n1. Create an Angular Application and try to call endpoints secured with [ValidateToken] or [AutoValidateToken]\r\n2. Angular cannot find HTTPOnly cookies because of their security principals\r\n3. Angular does not properly send the ValidationToken HTTPHeader \r\n** Example Repo: [Antiforgery Demo](https://github.com/itanex/AntiforgeryDemo)\r\n\r\n### Expected result\r\nExpected that because of the Architecture design, a developer using ValidateToken Configured for Angular Cookie and Header functionality, that the ValidationToken Cookie should be configured correctly.\r\n\r\n### Actual result\r\nAngular is prevented from reading the ValidationToken Cookie because it is set as HTTPOnly, which prevents angular calling endpoints secured with [ValidateToken] or [AutoValidateToken]\r\n\r\n### Further technical details\r\n\r\n[Documentation for AngularJS V1](https://docs.angularjs.org/api/ng/service/$http#cross-site-request-forgery-xsrf-protection) CSRF CookieToHeader Architecture \r\n\r\n[Wikipedia CSRF Cookie to Header](https://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-Header_Token) which states that by the architectural design of the CookieToHeader Architecture the ValidationToken cookie needs to be readable by JavaScript\r\n\r\nRoot of issue, ellipses for brevity\r\n\r\n    namespace Microsoft.AspNetCore.Antiforgery.Internal\r\n    {\r\n        public class DefaultAntiforgeryTokenStore : IAntiforgeryTokenStore\r\n        {\r\n            ...\r\n            \r\n            public void SaveCookieToken(HttpContext httpContext, string token)\r\n            {\r\n                ...\r\n                options.HttpOnly = true; // This is hardcoded and cannot be changed\r\n                ...\r\n            }\r\n\r\n            ...\r\n        }\r\n    }"},"comment":{"url":"https://api.github.com/repos/aspnet/Antiforgery/issues/comments/283504786","html_url":"https://github.com/aspnet/Antiforgery/issues/125#issuecomment-283504786","issue_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/125","id":283504786,"user":{"login":"itanex","id":430586,"avatar_url":"https://avatars1.githubusercontent.com/u/430586?v=3","gravatar_id":"","url":"https://api.github.com/users/itanex","html_url":"https://github.com/itanex","followers_url":"https://api.github.com/users/itanex/followers","following_url":"https://api.github.com/users/itanex/following{/other_user}","gists_url":"https://api.github.com/users/itanex/gists{/gist_id}","starred_url":"https://api.github.com/users/itanex/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/itanex/subscriptions","organizations_url":"https://api.github.com/users/itanex/orgs","repos_url":"https://api.github.com/users/itanex/repos","events_url":"https://api.github.com/users/itanex/events{/privacy}","received_events_url":"https://api.github.com/users/itanex/received_events","type":"User","site_admin":false},"created_at":"2017-03-01T23:23:46Z","updated_at":"2017-03-01T23:23:46Z","body":"The example does not support usage to variable routes, The example only creates a cookie when the path is  / or /index.html. This is not reusable in an angular app using Html5mode for its routing.\r\n\r\nAdditionally, Using my example in conjunction with [EditThisCookie](https://chrome.google.com/webstore/detail/editthiscookie/fngmhnnpilhplaeedifhccceomclgfbg?utm_source=chrome-app-launcher-info-dialog) you can actually change the cookie to be readable, reload the page and than submit a request that is accepted."}}
{"actor":{"display_login":"itanex"}}