Custom headers in request?

[dwbruhn]

I realize the purpose of this package is to abstract the network calls, though I find I can't use it in conjunction with CSRF protection. It would be awesome to have the ability to customize headers in each call (such as x-csrf-token)!

[Janpot]

Can't the token be passed to the rpc function in one of its arguments?

[dwbruhn]

That's true, If I were rolling my own CSRF protection, that would work. However, I'm using an off-the-shelf CSRF solution (https://github.com/krakenjs/lusca) that expects the token either in the top level of req.body or in a header:

https://github.com/krakenjs/lusca/blob/741de51c4c61c73a97950e41a282a15e12ebb5a8/lib/csrf.js#L155-L156

If I pass the CSRF token in the params to the RPC function, it gets JSON stringified inside req.body.params[0], which is not something lusca understands: