# HG changeset patch
# User Adam Chlipala <adam@chlipala.net>
# Date 1308937859 14400
# Node ID a10d080123ec6fa82222e6f48bc4c10c752050a3
# Parent  d65387bdc55774a2852dd3452784902337b04c48
'noXsrfProtection' .urp directive

diff -r d65387bdc557 -r a10d080123ec doc/manual.tex
--- a/doc/manual.tex	Thu Jun 23 08:44:03 2011 -0400
+++ b/doc/manual.tex	Fri Jun 24 13:50:59 2011 -0400
@@ -167,6 +167,7 @@
   \end{itemize}
 \item \texttt{link FILENAME} adds \texttt{FILENAME} to the list of files to be passed to the GCC linker at the end of compilation.  This is most useful for importing extra libraries needed by new FFI modules.
 \item \texttt{minHeap NUMBYTES} sets the initial size for thread-local heaps used in handling requests.  These heaps grow automatically as needed (up to any maximum set with \texttt{limit}), but each regrow requires restarting the request handling process.
+\item \texttt{noXsrfProtection URIPREFIX} turns off automatic cross-site request forgery protection for the page handler identified by the given URI prefix.  This will avoid checking cryptographic signatures on cookies, which is generally a reasonable idea for some pages, such as login pages that are going to discard all old cookie values, anyway.
 \item \texttt{onError Module.var} changes the handling of fatal application errors.  Instead of displaying a default, ugly error 500 page, the error page will be generated by calling function \texttt{Module.var} on a piece of XML representing the error message.  The error handler should have type $\mt{xbody} \to \mt{transaction} \; \mt{page}$.  Note that the error handler \emph{cannot} be in the application's main module, since that would register it as explicitly callable via URLs.
 \item \texttt{path NAME=VALUE} creates a mapping from \texttt{NAME} to \texttt{VALUE}.  This mapping may be used at the beginnings of filesystem paths given to various other configuration directives.  A path like \texttt{\$NAME/rest} is expanded to \texttt{VALUE/rest}.  There is an initial mapping from the empty name (for paths like \texttt{\$/list}) to the directory where the Ur/Web standard library is installed.  If you accept the default \texttt{configure} options, this directory is \texttt{/usr/local/lib/urweb/ur}.
 \item \texttt{prefix PREFIX} sets the prefix included before every URI within the generated application.  The default is \texttt{/}.
diff -r d65387bdc557 -r a10d080123ec src/cjr_print.sml
--- a/src/cjr_print.sml	Thu Jun 23 08:44:03 2011 -0400
+++ b/src/cjr_print.sml	Fri Jun 24 13:50:59 2011 -0400
@@ -2619,7 +2619,7 @@
                      newline,
                      string "if (*request == '/') ++request;",
                      newline,
-                     if couldWrite ek then
+                     if couldWrite ek andalso not (Settings.checkNoXsrfProtection s) then
                          box [string "{",
                               newline,
                               string "uw_Basis_string sig = ",
diff -r d65387bdc557 -r a10d080123ec src/compiler.sml
--- a/src/compiler.sml	Thu Jun 23 08:44:03 2011 -0400
+++ b/src/compiler.sml	Fri Jun 24 13:50:59 2011 -0400
@@ -780,6 +780,7 @@
                                          NONE => ErrorMsg.error ("invalid min heap '" ^ arg ^ "'")
                                        | SOME n => minHeap := n)
                                   | "alwaysInline" => Settings.addAlwaysInline arg
+                                  | "noXsrfProtection" => Settings.addNoXsrfProtection arg
 
                                   | _ => ErrorMsg.error ("Unrecognized command '" ^ cmd ^ "'");
                                 read ()
diff -r d65387bdc557 -r a10d080123ec src/settings.sig
--- a/src/settings.sig	Thu Jun 23 08:44:03 2011 -0400
+++ b/src/settings.sig	Fri Jun 24 13:50:59 2011 -0400
@@ -1,4 +1,4 @@
-(* Copyright (c) 2008-2010, Adam Chlipala
+(* Copyright (c) 2008-2011, Adam Chlipala
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -227,4 +227,7 @@
 
     val addAlwaysInline : string -> unit
     val checkAlwaysInline : string -> bool
+
+    val addNoXsrfProtection : string -> unit
+    val checkNoXsrfProtection : string -> bool
 end
diff -r d65387bdc557 -r a10d080123ec src/settings.sml
--- a/src/settings.sml	Thu Jun 23 08:44:03 2011 -0400
+++ b/src/settings.sml	Fri Jun 24 13:50:59 2011 -0400
@@ -1,4 +1,4 @@
-(* Copyright (c) 2008-2010, Adam Chlipala
+(* Copyright (c) 2008-2011, Adam Chlipala
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -570,4 +570,8 @@
 fun addAlwaysInline s = alwaysInline := SS.add (!alwaysInline, s)
 fun checkAlwaysInline s = SS.member (!alwaysInline, s)
 
+val noXsrfProtection = ref SS.empty
+fun addNoXsrfProtection s = noXsrfProtection := SS.add (!noXsrfProtection, s)
+fun checkNoXsrfProtection s = SS.member (!noXsrfProtection, s)
+
 end