930166 - Update all webmaker components to use the "csrf-token" meta name instead of "X-CSRF-TOKEN"

Status: RESOLVED FIXED

(Webmaker Graveyard :: webmaker.org, defect)

Description

[Christopher Yeleighton]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Firefox/24.0 (Beta/Release)
Build ID: 2013091200

Steps to reproduce:

Validate the page "Gallery - Mozilla Webmaker".


Actual results:

Errors found while checking this document as HTML5! 29 Errors, 1 warning(s), including:
Line 7, Column 63: Bad value X-CSRF-Token for attribute name on element meta: Keyword x-csrf-token is not registered.


Expected results:

Congratulations, etc.

Comment 1

[Pomax]

That's not an error, that's the validator being too strict. On that note, which validator is flagging this?

The only restriction on a meta element "name" attribute is that if it is specified, there MUST be an associated "content" attribute as well. Other than that, the "name" attribute can be any string. As such, using the string "X-CSRF-Token" cannot lead to a validation error under HTML5 rules.

Comment 2

[Pomax]

that said, the spec gives the following guideline for validators:

"Conformance checkers may use the information given on the WHATWG Wiki MetaExtensions page to establish if a value is allowed or not: values defined in this specification or marked as "proposed" or "ratified" must be accepted, whereas values marked as "discontinued" or not listed in either this specification or on the aforementioned page must be reported as invalid. Conformance checkers may cache this information (e.g. for performance reasons or to avoid the use of unreliable network connectivity)."

so we can either add the x-csrf-token as a proposal, or change the already proposed "csrf-token" name from applying to just "ruby" to simply being the name for csrf tokens irrespective of the underlying technology and switch from x-csrf-token to csrf-token instead.

Comment 3

[Pomax]

morphing to tracking ticket to update all projects to use "csrf-token" rather than "X-CSRF-TOKEN"

Comment 4

[Pomax]

Attachment: https://github.com/mozilla/goggles.webmaker.org/pull/64

patch for goggles

Comment 5

[Pomax]

Attachment: https://github.com/mozilla/login.webmaker.org/pull/203

patch for login

Comment 6

[Pomax]

Attachment: https://github.com/mozilla/thimble.webmaker.org/pull/289

patch for thimble

Comment 7

[Pomax]

Attachment: https://github.com/mozilla/popcorn.webmaker.org/pull/324

patch for popcorn

Comment 8

[Pomax]

Attachment: https://github.com/mozilla/webmaker.org/pull/501

patch for webmaker.org

Comment 9

[Pomax]

Attachment: https://github.com/mozilla/webmaker-profile/pull/210

patch for webmaker-profile

Comment 10

[Pomax]

Attachment: https://github.com/mozilla/MakeAPI/pull/171

patch for MakeAPI

Comment 11

[Pomax]

Attachment: https://github.com/mozilla/makeapi-client/pull/16

patch for makeapi-client

Comment 12

[Pomax]

To test these patches, you will need to check out "your" patch, as well as the login patch because that sets up the correct metaname-extraction-for-persona.

Comment 13

[Kieran Sedgwick (:sedge)]

Comment on attachment 833170 [details] [review]
https://github.com/mozilla/login.webmaker.org/pull/203

ARRRRRRRRRRR plus.

Comment 14

[Chris DeCairos (:cade)]

Comment on attachment 833177 [details] [review]
https://github.com/mozilla/MakeAPI/pull/171

I think should we change this line: https://github.com/mozilla/MakeAPI/blob/master/views/admin.html#L9 to ' name="csrf-token" ' as well as in views/login.html

Comment 15

[Chris DeCairos (:cade)]

Comment on attachment 833175 [details] [review]
https://github.com/mozilla/webmaker.org/pull/501

r+

Comment 16

[Chris DeCairos (:cade)]

Comment on attachment 833178 [details] [review]
https://github.com/mozilla/makeapi-client/pull/16

R+

You will want to tag this and update the apps that use it.

Comment 17

[Chris DeCairos (:cade)]

Comment on attachment 833177 [details] [review]
https://github.com/mozilla/MakeAPI/pull/171

Looks good with the changes for the admin+login pages.

Comment 18

[[github robot]]

Commit pushed to master at https://github.com/mozilla/makeapi-client

https://github.com/mozilla/makeapi-client/commit/6a34179668dcd8f18250bea0bed2c968d4a12adc
Merge pull request #16 from Pomax/bug930166

csrf-token rename

Comment 19

[[github robot]]

Commit pushed to master at https://github.com/mozilla/thimble.webmaker.org

https://github.com/mozilla/thimble.webmaker.org/commit/1856564f848d8de91665a3f809115866eb583daa
Merge pull request #289 from Pomax/bug930166

csrf-token rename

Comment 20

[[github robot]]

Commit pushed to master at https://github.com/mozilla/popcorn.webmaker.org

https://github.com/mozilla/popcorn.webmaker.org/commit/9a90d7912bbac75a9d459e7bdc3353bcfeee7865
Merge pull request #324 from Pomax/bug930166

csrf-token rename

Comment 21

[[github robot]]

Commit pushed to master at https://github.com/mozilla/webmaker-profile

https://github.com/mozilla/webmaker-profile/commit/9358634aa2e7c3c516fff0b585a0ea165a6a033a
Merge pull request #210 from Pomax/bug930166

csrf-token rename

Comment 22

[[github robot]]

Commit pushed to master at https://github.com/mozilla/goggles.webmaker.org

https://github.com/mozilla/goggles.webmaker.org/commit/df009784926c35e2b43a3a8dc036d9858ce763fa
Merge pull request #64 from Pomax/bug930166

csrf-token rename

Comment 23

[[github robot]]

Commit pushed to master at https://github.com/mozilla/login.webmaker.org

https://github.com/mozilla/login.webmaker.org/commit/539d6ecaf6e55a76be8a80709dce8034333a9ae6
Merge pull request #203 from Pomax/bug930166

csrf-token rename

Comment 24

[[github robot]]

Commit pushed to master at https://github.com/mozilla/MakeAPI

https://github.com/mozilla/MakeAPI/commit/f8d563e6c2ee97ffcdcb14a64dd3020f775ff6a1
Merge pull request #171 from Pomax/bug930166

csrf-token rename

Comment 25

[[github robot]]

Commit pushed to master at https://github.com/mozilla/webmaker.org

https://github.com/mozilla/webmaker.org/commit/40ff26342e71ebde9e0d45e027c7f4fa061eb272
Merge pull request #501 from Pomax/bug930166

csrf-token rename

Comment 26

[Pomax]

everything landed.