# HG changeset patch # User Adam Chlipala # Date 1308937859 14400 # Node ID a10d080123ec6fa82222e6f48bc4c10c752050a3 # Parent d65387bdc55774a2852dd3452784902337b04c48 'noXsrfProtection' .urp directive diff -r d65387bdc557 -r a10d080123ec doc/manual.tex --- a/doc/manual.tex Thu Jun 23 08:44:03 2011 -0400 +++ b/doc/manual.tex Fri Jun 24 13:50:59 2011 -0400 @@ -167,6 +167,7 @@ \end{itemize} \item \texttt{link FILENAME} adds \texttt{FILENAME} to the list of files to be passed to the GCC linker at the end of compilation. This is most useful for importing extra libraries needed by new FFI modules. \item \texttt{minHeap NUMBYTES} sets the initial size for thread-local heaps used in handling requests. These heaps grow automatically as needed (up to any maximum set with \texttt{limit}), but each regrow requires restarting the request handling process. +\item \texttt{noXsrfProtection URIPREFIX} turns off automatic cross-site request forgery protection for the page handler identified by the given URI prefix. This will avoid checking cryptographic signatures on cookies, which is generally a reasonable idea for some pages, such as login pages that are going to discard all old cookie values, anyway. \item \texttt{onError Module.var} changes the handling of fatal application errors. Instead of displaying a default, ugly error 500 page, the error page will be generated by calling function \texttt{Module.var} on a piece of XML representing the error message. The error handler should have type $\mt{xbody} \to \mt{transaction} \; \mt{page}$. Note that the error handler \emph{cannot} be in the application's main module, since that would register it as explicitly callable via URLs. \item \texttt{path NAME=VALUE} creates a mapping from \texttt{NAME} to \texttt{VALUE}. This mapping may be used at the beginnings of filesystem paths given to various other configuration directives. A path like \texttt{\$NAME/rest} is expanded to \texttt{VALUE/rest}. There is an initial mapping from the empty name (for paths like \texttt{\$/list}) to the directory where the Ur/Web standard library is installed. If you accept the default \texttt{configure} options, this directory is \texttt{/usr/local/lib/urweb/ur}. \item \texttt{prefix PREFIX} sets the prefix included before every URI within the generated application. The default is \texttt{/}. diff -r d65387bdc557 -r a10d080123ec src/cjr_print.sml --- a/src/cjr_print.sml Thu Jun 23 08:44:03 2011 -0400 +++ b/src/cjr_print.sml Fri Jun 24 13:50:59 2011 -0400 @@ -2619,7 +2619,7 @@ newline, string "if (*request == '/') ++request;", newline, - if couldWrite ek then + if couldWrite ek andalso not (Settings.checkNoXsrfProtection s) then box [string "{", newline, string "uw_Basis_string sig = ", diff -r d65387bdc557 -r a10d080123ec src/compiler.sml --- a/src/compiler.sml Thu Jun 23 08:44:03 2011 -0400 +++ b/src/compiler.sml Fri Jun 24 13:50:59 2011 -0400 @@ -780,6 +780,7 @@ NONE => ErrorMsg.error ("invalid min heap '" ^ arg ^ "'") | SOME n => minHeap := n) | "alwaysInline" => Settings.addAlwaysInline arg + | "noXsrfProtection" => Settings.addNoXsrfProtection arg | _ => ErrorMsg.error ("Unrecognized command '" ^ cmd ^ "'"); read () diff -r d65387bdc557 -r a10d080123ec src/settings.sig --- a/src/settings.sig Thu Jun 23 08:44:03 2011 -0400 +++ b/src/settings.sig Fri Jun 24 13:50:59 2011 -0400 @@ -1,4 +1,4 @@ -(* Copyright (c) 2008-2010, Adam Chlipala +(* Copyright (c) 2008-2011, Adam Chlipala * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -227,4 +227,7 @@ val addAlwaysInline : string -> unit val checkAlwaysInline : string -> bool + + val addNoXsrfProtection : string -> unit + val checkNoXsrfProtection : string -> bool end diff -r d65387bdc557 -r a10d080123ec src/settings.sml --- a/src/settings.sml Thu Jun 23 08:44:03 2011 -0400 +++ b/src/settings.sml Fri Jun 24 13:50:59 2011 -0400 @@ -1,4 +1,4 @@ -(* Copyright (c) 2008-2010, Adam Chlipala +(* Copyright (c) 2008-2011, Adam Chlipala * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -570,4 +570,8 @@ fun addAlwaysInline s = alwaysInline := SS.add (!alwaysInline, s) fun checkAlwaysInline s = SS.member (!alwaysInline, s) +val noXsrfProtection = ref SS.empty +fun addNoXsrfProtection s = noXsrfProtection := SS.add (!noXsrfProtection, s) +fun checkNoXsrfProtection s = SS.member (!noXsrfProtection, s) + end