<commit_before># CSRF

Cross-site request forgery ([CSRF][https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)]) is a type of attack which forces an end user to execute unwanted actions on a web application backend with which he/she is currently authenticated.  In other words, without protection, cookies stored in a browser like Google Chrome can be used to send requests to Chase.com from a user's computer whether that user is currently visiting Chase.com or Horrible-Hacker-Site.com.

### Enabling CSRF Protection

Sails bundles optional CSRF protection out of the box. To enable the built-in enforcement, just make the following adjustment to [sails.config.csrf](http://sailsjs.org/documentation/reference/Configuration/CSRF.html) (conventionally located in your project's [`config/csrf.js`](http://sailsjs.org/documentation/anatomy/myApp/config/csrf.js.html) file):

```js
csrf: true
```

Note that if you have existing code that communicates with your Sails backend via POST, PUT, or DELETE requests, you'll need to acquire a CSRF token and include it as a parameter or header in those requests.  More on that in a sec.
<commit_msg>Update CSRF.md<commit_after># CSRF

Cross-site request forgery ([CSRF](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF))) is a type of attack which forces an end user to execute unwanted actions on a web application backend with which he/she is currently authenticated.  In other words, without protection, cookies stored in a browser like Google Chrome can be used to send requests to Chase.com from a user's computer whether that user is currently visiting Chase.com or Horrible-Hacker-Site.com.

### Enabling CSRF Protection

Sails bundles optional CSRF protection out of the box. To enable the built-in enforcement, just make the following adjustment to [sails.config.csrf](http://sailsjs.org/documentation/reference/Configuration/CSRF.html) (conventionally located in your project's [`config/csrf.js`](http://sailsjs.org/documentation/anatomy/myApp/config/csrf.js.html) file):

```js
csrf: true
```

Note that if you have existing code that communicates with your Sails backend via POST, PUT, or DELETE requests, you'll need to acquire a CSRF token and include it as a parameter or header in those requests.  More on that in a sec.

{'fraction_non_alphanumeric': 0.07845687039445166, 'fraction_numerical': 0.0, 'mean_word_length': 4.9028132992327365, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2851165', 'n_tokens_mistral': 655, 'n_tokens_neox': 626, 'n_words': 285}