opendev/gerrit
Code Issues Proposed changes

Don't delete XSRF_TOKEN cookie after reading

Browse Source 
There is currently a race when multiple tabs of the same Gerrit site
are opened in quick succession, where one tab deletes the cookie from
the browser storage before the second tab has a chance to read it and
safe it in a global JS variable, resulting in the second tab thinking
it's logged out. The reasoning in Ie24051b4 for deleting the cookie
was always rather weak; now that we know that deleting it is harmful,
we should just leave it in.

Change-Id: I037206465255148e9c8ae14879e3147857475499
This commit is contained in:
Dave Borowitz
2016-02-10 15:44:19 -05:00
parent 669524de5d
commit 437e46ea7d
1 changed files with 0 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
gerrit-gwtui/src/main/java/com/google/gerrit/client/Gerrit.java
View File

@@ -422,7 +422,6 @@ public class Gerrit implements EntryPoint {
private void setXsrfToken() {
xGerritAuth = Cookies.getCookie(XSRF_COOKIE_NAME);
Cookies.removeCookie(XSRF_COOKIE_NAME);
JsonUtil.setDefaultXsrfManager(new XsrfManager() {
@Override
public String getToken(JsonDefTarget proxy) {