{"action":"created","issue":{"url":"https://api.github.com/repos/angular/angular.js/issues/13823","repository_url":"https://api.github.com/repos/angular/angular.js","labels_url":"https://api.github.com/repos/angular/angular.js/issues/13823/labels{/name}","comments_url":"https://api.github.com/repos/angular/angular.js/issues/13823/comments","events_url":"https://api.github.com/repos/angular/angular.js/issues/13823/events","html_url":"https://github.com/angular/angular.js/issues/13823","id":128169696,"number":13823,"title":"Angular can send XSRF token different from cookie for multiple parallel requests","user":{"login":"EntityB","id":5489782,"avatar_url":"https://avatars.githubusercontent.com/u/5489782?v=3","gravatar_id":"","url":"https://api.github.com/users/EntityB","html_url":"https://github.com/EntityB","followers_url":"https://api.github.com/users/EntityB/followers","following_url":"https://api.github.com/users/EntityB/following{/other_user}","gists_url":"https://api.github.com/users/EntityB/gists{/gist_id}","starred_url":"https://api.github.com/users/EntityB/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/EntityB/subscriptions","organizations_url":"https://api.github.com/users/EntityB/orgs","repos_url":"https://api.github.com/users/EntityB/repos","events_url":"https://api.github.com/users/EntityB/events{/privacy}","received_events_url":"https://api.github.com/users/EntityB/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/angular/angular.js/labels/component:%20$http","name":"component: $http","color":"d7e102"},{"url":"https://api.github.com/repos/angular/angular.js/labels/needs:%20investigation","name":"needs: investigation","color":"444444"},{"url":"https://api.github.com/repos/angular/angular.js/labels/severity:%20broken%20expected%20use","name":"severity: broken expected use","color":"fbda00"},{"url":"https://api.github.com/repos/angular/angular.js/labels/type:%20bug","name":"type: bug","color":"000000"}],"state":"open","locked":false,"assignee":{"login":"gkalpak","id":8604205,"avatar_url":"https://avatars.githubusercontent.com/u/8604205?v=3","gravatar_id":"","url":"https://api.github.com/users/gkalpak","html_url":"https://github.com/gkalpak","followers_url":"https://api.github.com/users/gkalpak/followers","following_url":"https://api.github.com/users/gkalpak/following{/other_user}","gists_url":"https://api.github.com/users/gkalpak/gists{/gist_id}","starred_url":"https://api.github.com/users/gkalpak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gkalpak/subscriptions","organizations_url":"https://api.github.com/users/gkalpak/orgs","repos_url":"https://api.github.com/users/gkalpak/repos","events_url":"https://api.github.com/users/gkalpak/events{/privacy}","received_events_url":"https://api.github.com/users/gkalpak/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/angular/angular.js/milestones/35","html_url":"https://github.com/angular/angular.js/milestones/Purgatory","labels_url":"https://api.github.com/repos/angular/angular.js/milestones/35/labels","id":526241,"number":35,"title":"Purgatory","description":"This milestone is for issues and PRs that weren't accepted yet and we are waiting for more info from the submitter.\r\n\r\nFor issues this typically means that we weren't able to reproduce the issue or we haven't decided yet if a feature request is a good idea at all.\r\n\r\nFor PRs this means that the PR still needs a lot of work and we might not even be interested in merging it because it looks like a non-core feature. We are still waiting for more discussion within the team or more info from the contributor before making the final decision.","creator":{"login":"IgorMinar","id":216296,"avatar_url":"https://avatars.githubusercontent.com/u/216296?v=3","gravatar_id":"","url":"https://api.github.com/users/IgorMinar","html_url":"https://github.com/IgorMinar","followers_url":"https://api.github.com/users/IgorMinar/followers","following_url":"https://api.github.com/users/IgorMinar/following{/other_user}","gists_url":"https://api.github.com/users/IgorMinar/gists{/gist_id}","starred_url":"https://api.github.com/users/IgorMinar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/IgorMinar/subscriptions","organizations_url":"https://api.github.com/users/IgorMinar/orgs","repos_url":"https://api.github.com/users/IgorMinar/repos","events_url":"https://api.github.com/users/IgorMinar/events{/privacy}","received_events_url":"https://api.github.com/users/IgorMinar/received_events","type":"User","site_admin":false},"open_issues":126,"closed_issues":615,"state":"open","created_at":"2014-01-04T01:20:50Z","updated_at":"2016-02-06T13:36:32Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2016-01-22T14:43:21Z","updated_at":"2016-02-07T20:57:44Z","closed_at":null,"body":"In our app (with Angular v1.2.29) **some** requests cleary sends different xsrf token that is in cookie. We exanimed request headers deeply from console. This results in xsrf attack detection in backend. \r\n\r\n[From doc about xsrf protection](https://docs.angularjs.org/api/ng/service/$http):\r\n\"When performing XHR requests, the $http service reads a token from a cookie (by default, XSRF-TOKEN) and sets it as an HTTP header (X-XSRF-TOKEN). \"\r\n\r\nIf Angular allows to happen any asynchronous code between **header is set for the XHR request** and **sending the request**, cookie might changed in the meantime, which will result in behavior that we are observing in our application (values are different for cookie and header).\r\n\r\nCorrect implementation would be set the header just before the request is send. "},"comment":{"url":"https://api.github.com/repos/angular/angular.js/issues/comments/181115083","html_url":"https://github.com/angular/angular.js/issues/13823#issuecomment-181115083","issue_url":"https://api.github.com/repos/angular/angular.js/issues/13823","id":181115083,"user":{"login":"hakanson","id":414500,"avatar_url":"https://avatars.githubusercontent.com/u/414500?v=3","gravatar_id":"","url":"https://api.github.com/users/hakanson","html_url":"https://github.com/hakanson","followers_url":"https://api.github.com/users/hakanson/followers","following_url":"https://api.github.com/users/hakanson/following{/other_user}","gists_url":"https://api.github.com/users/hakanson/gists{/gist_id}","starred_url":"https://api.github.com/users/hakanson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hakanson/subscriptions","organizations_url":"https://api.github.com/users/hakanson/orgs","repos_url":"https://api.github.com/users/hakanson/repos","events_url":"https://api.github.com/users/hakanson/events{/privacy}","received_events_url":"https://api.github.com/users/hakanson/received_events","type":"User","site_admin":false},"created_at":"2016-02-07T20:57:44Z","updated_at":"2016-02-07T20:57:44Z","body":"@bennadel has a blog post with similar race condition evidence. \r\n\r\nhttp://www.bennadel.com/blog/2991-cross-site-request-forgery-csrf-xsrf-race-condition-in-angularjs.htm"}}