-
Notifications
You must be signed in to change notification settings - Fork 25.1k
Update anti-request-forgery.md #34257
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
tdykstra
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Left a suggestion.
| ## Multiple browser tabs and the Synchronizer Token Pattern | ||
|
|
||
| With the Synchronizer Token Pattern, only the most recently loaded page contains a valid antiforgery token. Using multiple tabs can be problematic. For example, if a user opens multiple tabs: | ||
| With the Synchronizer Token Pattern, only the most recently loaded page is guaranteed to contain a valid antiforgery token. Apps that wish to support multiple tabs should test supported browsers and log failures. ***Using multiple tabs can be problematic***. For example, if a user opens multiple tabs: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The intro to the bulleted list is now out of sync with the list itself:
- is guaranteed to contain
- contains
Consider changing the second bullet with something similar, like "might fail with an error"
Suggestion that you can accept if you want is in the next comment
Co-authored-by: Tom Dykstra <[email protected]>
Fixes #25564
Internal previews