From 60c9b6bc087186083c2195edea81442a9fe86704 Mon Sep 17 00:00:00 2001 From: Bunyamin Coskuner Date: Fri, 15 Jan 2021 12:17:02 +0300 Subject: [PATCH] docs: add small note about xsrf token setup --- docs/en/CSRF-Anti-Forgery.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/docs/en/CSRF-Anti-Forgery.md b/docs/en/CSRF-Anti-Forgery.md index 720edc5924..ee684aaa52 100644 --- a/docs/en/CSRF-Anti-Forgery.md +++ b/docs/en/CSRF-Anti-Forgery.md @@ -144,4 +144,19 @@ Let's talk about why. First, take a look at [Angular's code](https://github.com/angular/angular/blob/master/packages/common/http/src/xsrf.ts#L81) -It does not intercept any request that starts with `http://` or `https://`. There is a good reason for that. Any cross-site request does not need this token for security. This verification is only valid if the request is made to the same domain from which the web page is served. So, simply put, if you serve everything from a single domain, you just use a relative path. \ No newline at end of file +It does not intercept any request that starts with `http://` or `https://`. There is a good reason for that. Any cross-site request does not need this token for security. This verification is only valid if the request is made to the same domain from which the web page is served. So, simply put, if you serve everything from a single domain, you just use a relative path. + +If you serve your APIs from the root, i.e. no context root (https://testdomain.com/api/identity/users), leave `url` empty as follows: + +```typescript +export const environment = { + production: true, + // .... + apis: { + default: { + url: '', // <- should be empty string, not '/' + // ... + }, + }, +} as Config.Environment; +```