Adding xsrf protection

dist/axios.amd.js

@@ -50,12 +50,14 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 /* 1 */
 /***/ function(module, exports, __webpack_require__) {
 
-	var Promise = __webpack_require__(7).Promise;
+	var Promise = __webpack_require__(9).Promise;
 	var buildUrl = __webpack_require__(2);
-	var defaults = __webpack_require__(3);
+	var cookies = __webpack_require__(3);
-	var parseHeaders = __webpack_require__(4);
+	var defaults = __webpack_require__(4);
-	var transformData = __webpack_require__(5);
+	var parseHeaders = __webpack_require__(5);
-	var utils = __webpack_require__(6);
+	var transformData = __webpack_require__(6);
+	var urlIsSameOrigin = __webpack_require__(7);
+	var utils = __webpack_require__(8);
 	
 	var axios = module.exports = function axios(options) {
 	  options = utils.merge({
@@ -114,9 +116,17 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 	      options.headers || {}
 	    );
 	
+	    // Add xsrf header
+	    var xsrfValue = urlIsSameOrigin(options.url)
+	        ? cookies.read(options.xsrfCookieName || defaults.xsrfCookieName)
+	        : undefined;
+	    if (xsrfValue) {
+	      headers[options.xsrfHeaderName || defaults.xsrfHeaderName] = xsrfValue;
+	    }
+	
 	    utils.forEach(headers, function (val, key) {
 	      // Remove Content-Type if data is undefined
-	      if (typeof data === 'undefined' && key.toLowerCase() === 'content-type') {
+	      if (!data && key.toLowerCase() === 'content-type') {
 	        delete headers[key];
 	      }
 	      // Otherwise add header to the request
@@ -200,7 +210,7 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 
 	'use strict';
 	
-	var utils = __webpack_require__(6);
+	var utils = __webpack_require__(8);
 	
 	function encode(val) {
 	  return encodeURIComponent(val).
@@ -250,7 +260,49 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 
 	'use strict';
 	
-	var utils = __webpack_require__(6);
+	var utils = __webpack_require__(8);
+	
+	module.exports = {
+	  write: function (name, value, expires, path, domain, secure) {
+	    var cookie = [];
+	    cookie.push(name + '=' + encodeURIComponent(value));
+	
+	    if (utils.isNumber(expires)) {
+	      cookie.push('expires=' + new Date(exires).toGMTString());
+	    }
+	
+	    if (utils.isString(path)) {
+	      cookie.push('path=' + path);
+	    }
+	
+	    if (utils.isString(domain)) {
+	      cookie.push('domain=' + domain);
+	    }
+	
+	    if (secure === true) {
+	      cookie.push('secure');
+	    }
+	
+	    document.cookie = cookie.join('; ');
+	  },
+	
+	  read: function (name) {
+	    var match = document.cookie.match(new RegExp('(^|;\\s*)(' + name + ')=([^;]*)'));
+	    return (match ? decodeURIComponent(match[3]) : null);
+	  },
+	
+	  remove: function (name) {
+	    this.write(name, '', Date.now() - 86400000);
+	  }
+	};
+
+/***/ },
+/* 4 */
+/***/ function(module, exports, __webpack_require__) {
+
+	'use strict';
+	
+	var utils = __webpack_require__(8);
 	
 	var JSON_START = /^\s*(\[|\{[^\{])/;
 	var JSON_END = /[\}\]]\s*$/;
@@ -286,17 +338,17 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 	    put: utils.merge(CONTENT_TYPE_APPLICATION_JSON)
 	  },
 	
-	  xsrfCookiName: 'XSRF-TOKEN',
+	  xsrfCookieName: 'XSRF-TOKEN',
 	  xsrfHeaderName: 'X-XSRF-TOKEN'
 	};
 
 /***/ },
-/* 4 */
+/* 5 */
 /***/ function(module, exports, __webpack_require__) {
 
 	'use strict';
 	
-	var utils = __webpack_require__(6);
+	var utils = __webpack_require__(8);
 	
 	/**
 	 * Parse headers into an object
@@ -330,12 +382,12 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 	};
 
 /***/ },
-/* 5 */
+/* 6 */
 /***/ function(module, exports, __webpack_require__) {
 
 	'use strict';
 	
-	var utils = __webpack_require__(6);
+	var utils = __webpack_require__(8);
 	
 	/**
 	 * Transform the data for a request or a response
@@ -354,7 +406,62 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 	};
 
 /***/ },
-/* 6 */
+/* 7 */
+/***/ function(module, exports, __webpack_require__) {
+
+	'use strict';
+	
+	var msie = /trident/i.test(navigator.userAgent);
+	var utils = __webpack_require__(8);
+	var urlParsingNode = document.createElement('a');
+	var originUrl = urlResolve(window.location.href);
+	
+	/**
+	 * Parse a URL to discover it's components
+	 *
+	 * @param {String} url The URL to be parsed
+	 * @returns {Object}
+	 */
+	function urlResolve(url) {
+	  var href = url;
+	
+	  if (msie) {
+	    // IE needs attribute set twice to normalize properties
+	    urlParsingNode.setAttribute('href', href);
+	    href = urlParsingNode.href;
+	  }
+	
+	  urlParsingNode.setAttribute('href', href);
+	
+	  // urlParsingNode provides the UrlUtils interface - http://url.spec.whatwg.org/#urlutils
+	  return {
+	    href: urlParsingNode.href,
+	    protocol: urlParsingNode.protocol ? urlParsingNode.protocol.replace(/:$/, '') : '',
+	    host: urlParsingNode.host,
+	    search: urlParsingNode.search ? urlParsingNode.search.replace(/^\?/, '') : '',
+	    hash: urlParsingNode.hash ? urlParsingNode.hash.replace(/^#/, '') : '',
+	    hostname: urlParsingNode.hostname,
+	    port: urlParsingNode.port,
+	    pathname: (urlParsingNode.pathname.charAt(0) === '/')
+	      ? urlParsingNode.pathname
+	      : '/' + urlParsingNode.pathname
+	  };
+	}
+	
+	/**
+	 * Determine if a URL shares the same origin as the current location
+	 *
+	 * @param {String} requestUrl The URL to test
+	 * @returns {boolean} True if URL shares the same origin, otherwise false
+	 */
+	module.exports = function urlIsSameOrigin(requestUrl) {
+	  var parsed = (utils.isString(requestUrl)) ? urlResolve(requestUrl) : requestUrl;
+	  return (parsed.protocol === originUrl.protocol &&
+	        parsed.host === originUrl.host);
+	};
+
+/***/ },
+/* 8 */
 /***/ function(module, exports, __webpack_require__) {
 
 	// utils is a library of generic helper functions non-specific to axios
@@ -371,6 +478,26 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 	  return toString.call(val) === '[object Array]';
 	}
 	
+	/**
+	 * Determine if a value is a String
+	 *
+	 * @param {Object} val The value to test
+	 * @returns {boolean} True if value is a String, otherwise false
+	 */
+	function isString(val) {
+	  return typeof val === 'string';
+	}
+	
+	/**
+	 * Determine if a value is a Number
+	 *
+	 * @param {Object} val The value to test
+	 * @returns {boolean} True if value is a Number, otherwise false
+	 */
+	function isNumber(val) {
+	  return typeof val === 'number';
+	}
+	
 	/**
 	 * Determine if a value is an Object
 	 *
@@ -408,7 +535,7 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 	 * @returns {boolean} True if value is a Blob, otherwise false
 	 */
 	function isBlob(val) {
-	  return toString.call(val) !== '[object Blob]';
+	  return toString.call(val) === '[object Blob]';
 	}
 	
 	/**
@@ -492,6 +619,8 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 	
 	module.exports = {
 	  isArray: isArray,
+	  isString: isString,
+	  isNumber: isNumber,
 	  isObject: isObject,
 	  isDate: isDate,
 	  isFile: isFile,
@@ -502,30 +631,30 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 	};
 
 /***/ },
-/* 7 */
+/* 9 */
 /***/ function(module, exports, __webpack_require__) {
 
 	"use strict";
-	var Promise = __webpack_require__(8).Promise;
+	var Promise = __webpack_require__(10).Promise;
-	var polyfill = __webpack_require__(9).polyfill;
+	var polyfill = __webpack_require__(11).polyfill;
 	exports.Promise = Promise;
 	exports.polyfill = polyfill;
 
 /***/ },
-/* 8 */
+/* 10 */
 /***/ function(module, exports, __webpack_require__) {
 
 	"use strict";
-	var config = __webpack_require__(10).config;
+	var config = __webpack_require__(12).config;
-	var configure = __webpack_require__(10).configure;
+	var configure = __webpack_require__(12).configure;
-	var objectOrFunction = __webpack_require__(11).objectOrFunction;
+	var objectOrFunction = __webpack_require__(13).objectOrFunction;
-	var isFunction = __webpack_require__(11).isFunction;
+	var isFunction = __webpack_require__(13).isFunction;
-	var now = __webpack_require__(11).now;
+	var now = __webpack_require__(13).now;
-	var all = __webpack_require__(12).all;
+	var all = __webpack_require__(14).all;
-	var race = __webpack_require__(13).race;
+	var race = __webpack_require__(15).race;
-	var staticResolve = __webpack_require__(14).resolve;
+	var staticResolve = __webpack_require__(16).resolve;
-	var staticReject = __webpack_require__(15).reject;
+	var staticReject = __webpack_require__(17).reject;
-	var asap = __webpack_require__(16).asap;
+	var asap = __webpack_require__(18).asap;
 	
 	var counter = 0;
 	
@@ -728,13 +857,13 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 	exports.Promise = Promise;
 
 /***/ },
-/* 9 */
+/* 11 */
 /***/ function(module, exports, __webpack_require__) {
 
 	/* WEBPACK VAR INJECTION */(function(global) {"use strict";
 	/*global self*/
-	var RSVPPromise = __webpack_require__(8).Promise;
+	var RSVPPromise = __webpack_require__(10).Promise;
-	var isFunction = __webpack_require__(11).isFunction;
+	var isFunction = __webpack_require__(13).isFunction;
 	
 	function polyfill() {
 	  var local;
@@ -772,7 +901,7 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 	/* WEBPACK VAR INJECTION */}.call(exports, (function() { return this; }())))
 
 /***/ },
-/* 10 */
+/* 12 */
 /***/ function(module, exports, __webpack_require__) {
 
 	"use strict";
@@ -792,7 +921,7 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 	exports.configure = configure;
 
 /***/ },
-/* 11 */
+/* 13 */
 /***/ function(module, exports, __webpack_require__) {
 
 	"use strict";
@@ -819,14 +948,14 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 	exports.now = now;
 
 /***/ },
-/* 12 */
+/* 14 */
 /***/ function(module, exports, __webpack_require__) {
 
 	"use strict";
 	/* global toString */
 	
-	var isArray = __webpack_require__(11).isArray;
+	var isArray = __webpack_require__(13).isArray;
-	var isFunction = __webpack_require__(11).isFunction;
+	var isFunction = __webpack_require__(13).isFunction;
 	
 	/**
 	  Returns a promise that is fulfilled when all the given promises have been
@@ -917,12 +1046,12 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 	exports.all = all;
 
 /***/ },
-/* 13 */
+/* 15 */
 /***/ function(module, exports, __webpack_require__) {
 
 	"use strict";
 	/* global toString */
-	var isArray = __webpack_require__(11).isArray;
+	var isArray = __webpack_require__(13).isArray;
 	
 	/**
 	  `RSVP.race` allows you to watch a series of promises and act as soon as the
@@ -1011,7 +1140,7 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 	exports.race = race;
 
 /***/ },
-/* 14 */
+/* 16 */
 /***/ function(module, exports, __webpack_require__) {
 
 	"use strict";
@@ -1031,7 +1160,7 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 	exports.resolve = resolve;
 
 /***/ },
-/* 15 */
+/* 17 */
 /***/ function(module, exports, __webpack_require__) {
 
 	"use strict";
@@ -1083,7 +1212,7 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 	exports.reject = reject;
 
 /***/ },
-/* 16 */
+/* 18 */
 /***/ function(module, exports, __webpack_require__) {
 
 	/* WEBPACK VAR INJECTION */(function(global, process) {"use strict";
@@ -1147,10 +1276,10 @@ define("axios", [], function() { return /******/ (function(modules) { // webpack
 	}
 	
 	exports.asap = asap;
-	/* WEBPACK VAR INJECTION */}.call(exports, (function() { return this; }()), __webpack_require__(17)))
+	/* WEBPACK VAR INJECTION */}.call(exports, (function() { return this; }()), __webpack_require__(19)))
 
 /***/ },
-/* 17 */
+/* 19 */
 /***/ function(module, exports, __webpack_require__) {
 
 	// shim for using process in browser

dist/axios.js

@@ -51,12 +51,14 @@ var axios =
 /* 1 */
 /***/ function(module, exports, __webpack_require__) {
 
-	var Promise = __webpack_require__(7).Promise;
+	var Promise = __webpack_require__(9).Promise;
 	var buildUrl = __webpack_require__(2);
-	var defaults = __webpack_require__(3);
+	var cookies = __webpack_require__(3);
-	var parseHeaders = __webpack_require__(4);
+	var defaults = __webpack_require__(4);
-	var transformData = __webpack_require__(5);
+	var parseHeaders = __webpack_require__(5);
-	var utils = __webpack_require__(6);
+	var transformData = __webpack_require__(6);
+	var urlIsSameOrigin = __webpack_require__(7);
+	var utils = __webpack_require__(8);
 	
 	var axios = module.exports = function axios(options) {
 	  options = utils.merge({
@@ -115,9 +117,17 @@ var axios =
 	      options.headers || {}
 	    );
 	
+	    // Add xsrf header
+	    var xsrfValue = urlIsSameOrigin(options.url)
+	        ? cookies.read(options.xsrfCookieName || defaults.xsrfCookieName)
+	        : undefined;
+	    if (xsrfValue) {
+	      headers[options.xsrfHeaderName || defaults.xsrfHeaderName] = xsrfValue;
+	    }
+	
 	    utils.forEach(headers, function (val, key) {
 	      // Remove Content-Type if data is undefined
-	      if (typeof data === 'undefined' && key.toLowerCase() === 'content-type') {
+	      if (!data && key.toLowerCase() === 'content-type') {
 	        delete headers[key];
 	      }
 	      // Otherwise add header to the request
@@ -201,7 +211,7 @@ var axios =
 
 	'use strict';
 	
-	var utils = __webpack_require__(6);
+	var utils = __webpack_require__(8);
 	
 	function encode(val) {
 	  return encodeURIComponent(val).
@@ -251,7 +261,49 @@ var axios =
 
 	'use strict';
 	
-	var utils = __webpack_require__(6);
+	var utils = __webpack_require__(8);
+	
+	module.exports = {
+	  write: function write(name, value, expires, path, domain, secure) {
+	    var cookie = [];
+	    cookie.push(name + '=' + encodeURIComponent(value));
+	
+	    if (utils.isNumber(expires)) {
+	      cookie.push('expires=' + new Date(expires).toGMTString());
+	    }
+	
+	    if (utils.isString(path)) {
+	      cookie.push('path=' + path);
+	    }
+	
+	    if (utils.isString(domain)) {
+	      cookie.push('domain=' + domain);
+	    }
+	
+	    if (secure === true) {
+	      cookie.push('secure');
+	    }
+	
+	    document.cookie = cookie.join('; ');
+	  },
+	
+	  read: function read(name) {
+	    var match = document.cookie.match(new RegExp('(^|;\\s*)(' + name + ')=([^;]*)'));
+	    return (match ? decodeURIComponent(match[3]) : null);
+	  },
+	
+	  remove: function remove(name) {
+	    this.write(name, '', Date.now() - 86400000);
+	  }
+	};
+
+/***/ },
+/* 4 */
+/***/ function(module, exports, __webpack_require__) {
+
+	'use strict';
+	
+	var utils = __webpack_require__(8);
 	
 	var JSON_START = /^\s*(\[|\{[^\{])/;
 	var JSON_END = /[\}\]]\s*$/;
@@ -287,17 +339,17 @@ var axios =
 	    put: utils.merge(CONTENT_TYPE_APPLICATION_JSON)
 	  },
 	
-	  xsrfCookiName: 'XSRF-TOKEN',
+	  xsrfCookieName: 'XSRF-TOKEN',
 	  xsrfHeaderName: 'X-XSRF-TOKEN'
 	};
 
 /***/ },
-/* 4 */
+/* 5 */
 /***/ function(module, exports, __webpack_require__) {
 
 	'use strict';
 	
-	var utils = __webpack_require__(6);
+	var utils = __webpack_require__(8);
 	
 	/**
 	 * Parse headers into an object
@@ -331,12 +383,12 @@ var axios =
 	};
 
 /***/ },
-/* 5 */
+/* 6 */
 /***/ function(module, exports, __webpack_require__) {
 
 	'use strict';
 	
-	var utils = __webpack_require__(6);
+	var utils = __webpack_require__(8);
 	
 	/**
 	 * Transform the data for a request or a response
@@ -355,7 +407,62 @@ var axios =
 	};
 
 /***/ },
-/* 6 */
+/* 7 */
+/***/ function(module, exports, __webpack_require__) {
+
+	'use strict';
+	
+	var msie = /(msie|trident)/i.test(navigator.userAgent);
+	var utils = __webpack_require__(8);
+	var urlParsingNode = document.createElement('a');
+	var originUrl = urlResolve(window.location.href);
+	
+	/**
+	 * Parse a URL to discover it's components
+	 *
+	 * @param {String} url The URL to be parsed
+	 * @returns {Object}
+	 */
+	function urlResolve(url) {
+	  var href = url;
+	
+	  if (msie) {
+	    // IE needs attribute set twice to normalize properties
+	    urlParsingNode.setAttribute('href', href);
+	    href = urlParsingNode.href;
+	  }
+	
+	  urlParsingNode.setAttribute('href', href);
+	
+	  // urlParsingNode provides the UrlUtils interface - http://url.spec.whatwg.org/#urlutils
+	  return {
+	    href: urlParsingNode.href,
+	    protocol: urlParsingNode.protocol ? urlParsingNode.protocol.replace(/:$/, '') : '',
+	    host: urlParsingNode.host,
+	    search: urlParsingNode.search ? urlParsingNode.search.replace(/^\?/, '') : '',
+	    hash: urlParsingNode.hash ? urlParsingNode.hash.replace(/^#/, '') : '',
+	    hostname: urlParsingNode.hostname,
+	    port: urlParsingNode.port,
+	    pathname: (urlParsingNode.pathname.charAt(0) === '/')
+	      ? urlParsingNode.pathname
+	      : '/' + urlParsingNode.pathname
+	  };
+	}
+	
+	/**
+	 * Determine if a URL shares the same origin as the current location
+	 *
+	 * @param {String} requestUrl The URL to test
+	 * @returns {boolean} True if URL shares the same origin, otherwise false
+	 */
+	module.exports = function urlIsSameOrigin(requestUrl) {
+	  var parsed = (utils.isString(requestUrl)) ? urlResolve(requestUrl) : requestUrl;
+	  return (parsed.protocol === originUrl.protocol &&
+	        parsed.host === originUrl.host);
+	};
+
+/***/ },
+/* 8 */
 /***/ function(module, exports, __webpack_require__) {
 
 	// utils is a library of generic helper functions non-specific to axios
@@ -372,6 +479,26 @@ var axios =
 	  return toString.call(val) === '[object Array]';
 	}
 	
+	/**
+	 * Determine if a value is a String
+	 *
+	 * @param {Object} val The value to test
+	 * @returns {boolean} True if value is a String, otherwise false
+	 */
+	function isString(val) {
+	  return typeof val === 'string';
+	}
+	
+	/**
+	 * Determine if a value is a Number
+	 *
+	 * @param {Object} val The value to test
+	 * @returns {boolean} True if value is a Number, otherwise false
+	 */
+	function isNumber(val) {
+	  return typeof val === 'number';
+	}
+	
 	/**
 	 * Determine if a value is an Object
 	 *
@@ -409,7 +536,7 @@ var axios =
 	 * @returns {boolean} True if value is a Blob, otherwise false
 	 */
 	function isBlob(val) {
-	  return toString.call(val) !== '[object Blob]';
+	  return toString.call(val) === '[object Blob]';
 	}
 	
 	/**
@@ -493,6 +620,8 @@ var axios =
 	
 	module.exports = {
 	  isArray: isArray,
+	  isString: isString,
+	  isNumber: isNumber,
 	  isObject: isObject,
 	  isDate: isDate,
 	  isFile: isFile,
@@ -503,30 +632,30 @@ var axios =
 	};
 
 /***/ },
-/* 7 */
+/* 9 */
 /***/ function(module, exports, __webpack_require__) {
 
 	"use strict";
-	var Promise = __webpack_require__(8).Promise;
+	var Promise = __webpack_require__(10).Promise;
-	var polyfill = __webpack_require__(9).polyfill;
+	var polyfill = __webpack_require__(11).polyfill;
 	exports.Promise = Promise;
 	exports.polyfill = polyfill;
 
 /***/ },
-/* 8 */
+/* 10 */
 /***/ function(module, exports, __webpack_require__) {
 
 	"use strict";
-	var config = __webpack_require__(10).config;
+	var config = __webpack_require__(12).config;
-	var configure = __webpack_require__(10).configure;
+	var configure = __webpack_require__(12).configure;
-	var objectOrFunction = __webpack_require__(11).objectOrFunction;
+	var objectOrFunction = __webpack_require__(13).objectOrFunction;
-	var isFunction = __webpack_require__(11).isFunction;
+	var isFunction = __webpack_require__(13).isFunction;
-	var now = __webpack_require__(11).now;
+	var now = __webpack_require__(13).now;
-	var all = __webpack_require__(12).all;
+	var all = __webpack_require__(14).all;
-	var race = __webpack_require__(13).race;
+	var race = __webpack_require__(15).race;
-	var staticResolve = __webpack_require__(14).resolve;
+	var staticResolve = __webpack_require__(16).resolve;
-	var staticReject = __webpack_require__(15).reject;
+	var staticReject = __webpack_require__(17).reject;
-	var asap = __webpack_require__(16).asap;
+	var asap = __webpack_require__(18).asap;
 	
 	var counter = 0;
 	
@@ -729,13 +858,13 @@ var axios =
 	exports.Promise = Promise;
 
 /***/ },
-/* 9 */
+/* 11 */
 /***/ function(module, exports, __webpack_require__) {
 
 	/* WEBPACK VAR INJECTION */(function(global) {"use strict";
 	/*global self*/
-	var RSVPPromise = __webpack_require__(8).Promise;
+	var RSVPPromise = __webpack_require__(10).Promise;
-	var isFunction = __webpack_require__(11).isFunction;
+	var isFunction = __webpack_require__(13).isFunction;
 	
 	function polyfill() {
 	  var local;
@@ -773,7 +902,7 @@ var axios =
 	/* WEBPACK VAR INJECTION */}.call(exports, (function() { return this; }())))
 
 /***/ },
-/* 10 */
+/* 12 */
 /***/ function(module, exports, __webpack_require__) {
 
 	"use strict";
@@ -793,7 +922,7 @@ var axios =
 	exports.configure = configure;
 
 /***/ },
-/* 11 */
+/* 13 */
 /***/ function(module, exports, __webpack_require__) {
 
 	"use strict";
@@ -820,14 +949,14 @@ var axios =
 	exports.now = now;
 
 /***/ },
-/* 12 */
+/* 14 */
 /***/ function(module, exports, __webpack_require__) {
 
 	"use strict";
 	/* global toString */
 	
-	var isArray = __webpack_require__(11).isArray;
+	var isArray = __webpack_require__(13).isArray;
-	var isFunction = __webpack_require__(11).isFunction;
+	var isFunction = __webpack_require__(13).isFunction;
 	
 	/**
 	  Returns a promise that is fulfilled when all the given promises have been
@@ -918,12 +1047,12 @@ var axios =
 	exports.all = all;
 
 /***/ },
-/* 13 */
+/* 15 */
 /***/ function(module, exports, __webpack_require__) {
 
 	"use strict";
 	/* global toString */
-	var isArray = __webpack_require__(11).isArray;
+	var isArray = __webpack_require__(13).isArray;
 	
 	/**
 	  `RSVP.race` allows you to watch a series of promises and act as soon as the
@@ -1012,7 +1141,7 @@ var axios =
 	exports.race = race;
 
 /***/ },
-/* 14 */
+/* 16 */
 /***/ function(module, exports, __webpack_require__) {
 
 	"use strict";
@@ -1032,7 +1161,7 @@ var axios =
 	exports.resolve = resolve;
 
 /***/ },
-/* 15 */
+/* 17 */
 /***/ function(module, exports, __webpack_require__) {
 
 	"use strict";
@@ -1084,7 +1213,7 @@ var axios =
 	exports.reject = reject;
 
 /***/ },
-/* 16 */
+/* 18 */
 /***/ function(module, exports, __webpack_require__) {
 
 	/* WEBPACK VAR INJECTION */(function(global, process) {"use strict";
@@ -1148,10 +1277,10 @@ var axios =
 	}
 	
 	exports.asap = asap;
-	/* WEBPACK VAR INJECTION */}.call(exports, (function() { return this; }()), __webpack_require__(17)))
+	/* WEBPACK VAR INJECTION */}.call(exports, (function() { return this; }()), __webpack_require__(19)))
 
 /***/ },
-/* 17 */
+/* 19 */
 /***/ function(module, exports, __webpack_require__) {
 
 	// shim for using process in browser

lib/axios.js

@@ -1,8 +1,10 @@
 var Promise = require('es6-promise').Promise;
 var buildUrl = require('./buildUrl');
+var cookies = require('./cookies');
 var defaults = require('./defaults');
 var parseHeaders = require('./parseHeaders');
 var transformData = require('./transformData');
+var urlIsSameOrigin = require('./urlIsSameOrigin');
 var utils = require('./utils');
 
 var axios = module.exports = function axios(options) {
@@ -62,9 +64,17 @@ var axios = module.exports = function axios(options) {
       options.headers || {}
     );
 
+    // Add xsrf header
+    var xsrfValue = urlIsSameOrigin(options.url)
+        ? cookies.read(options.xsrfCookieName || defaults.xsrfCookieName)
+        : undefined;
+    if (xsrfValue) {
+      headers[options.xsrfHeaderName || defaults.xsrfHeaderName] = xsrfValue;
+    }
+
     utils.forEach(headers, function (val, key) {
       // Remove Content-Type if data is undefined
-      if (typeof data === 'undefined' && key.toLowerCase() === 'content-type') {
+      if (!data && key.toLowerCase() === 'content-type') {
         delete headers[key];
       }
       // Otherwise add header to the request

lib/cookies.js

@@ -0,0 +1,37 @@
+'use strict';
+
+var utils = require('./utils');
+
+module.exports = {
+  write: function write(name, value, expires, path, domain, secure) {
+    var cookie = [];
+    cookie.push(name + '=' + encodeURIComponent(value));
+
+    if (utils.isNumber(expires)) {
+      cookie.push('expires=' + new Date(expires).toGMTString());
+    }
+
+    if (utils.isString(path)) {
+      cookie.push('path=' + path);
+    }
+
+    if (utils.isString(domain)) {
+      cookie.push('domain=' + domain);
+    }
+
+    if (secure === true) {
+      cookie.push('secure');
+    }
+
+    document.cookie = cookie.join('; ');
+  },
+
+  read: function read(name) {
+    var match = document.cookie.match(new RegExp('(^|;\\s*)(' + name + ')=([^;]*)'));
+    return (match ? decodeURIComponent(match[3]) : null);
+  },
+
+  remove: function remove(name) {
+    this.write(name, '', Date.now() - 86400000);
+  }
+};

lib/urlIsSameOrigin.js

@@ -0,0 +1,50 @@
+'use strict';
+
+var msie = /(msie|trident)/i.test(navigator.userAgent);
+var utils = require('./utils');
+var urlParsingNode = document.createElement('a');
+var originUrl = urlResolve(window.location.href);
+
+/**
+ * Parse a URL to discover it's components
+ *
+ * @param {String} url The URL to be parsed
+ * @returns {Object}
+ */
+function urlResolve(url) {
+  var href = url;
+
+  if (msie) {
+    // IE needs attribute set twice to normalize properties
+    urlParsingNode.setAttribute('href', href);
+    href = urlParsingNode.href;
+  }
+
+  urlParsingNode.setAttribute('href', href);
+
+  // urlParsingNode provides the UrlUtils interface - http://url.spec.whatwg.org/#urlutils
+  return {
+    href: urlParsingNode.href,
+    protocol: urlParsingNode.protocol ? urlParsingNode.protocol.replace(/:$/, '') : '',
+    host: urlParsingNode.host,
+    search: urlParsingNode.search ? urlParsingNode.search.replace(/^\?/, '') : '',
+    hash: urlParsingNode.hash ? urlParsingNode.hash.replace(/^#/, '') : '',
+    hostname: urlParsingNode.hostname,
+    port: urlParsingNode.port,
+    pathname: (urlParsingNode.pathname.charAt(0) === '/')
+      ? urlParsingNode.pathname
+      : '/' + urlParsingNode.pathname
+  };
+}
+
+/**
+ * Determine if a URL shares the same origin as the current location
+ *
+ * @param {String} requestUrl The URL to test
+ * @returns {boolean} True if URL shares the same origin, otherwise false
+ */
+module.exports = function urlIsSameOrigin(requestUrl) {
+  var parsed = (utils.isString(requestUrl)) ? urlResolve(requestUrl) : requestUrl;
+  return (parsed.protocol === originUrl.protocol &&
+        parsed.host === originUrl.host);
+};

lib/utils.js

@@ -12,6 +12,26 @@ function isArray(val) {
   return toString.call(val) === '[object Array]';
 }
 
+/**
+ * Determine if a value is a String
+ *
+ * @param {Object} val The value to test
+ * @returns {boolean} True if value is a String, otherwise false
+ */
+function isString(val) {
+  return typeof val === 'string';
+}
+
+/**
+ * Determine if a value is a Number
+ *
+ * @param {Object} val The value to test
+ * @returns {boolean} True if value is a Number, otherwise false
+ */
+function isNumber(val) {
+  return typeof val === 'number';
+}
+
 /**
  * Determine if a value is an Object
  *
@@ -49,7 +69,7 @@ function isFile(val) {
  * @returns {boolean} True if value is a Blob, otherwise false
  */
 function isBlob(val) {
-  return toString.call(val) !== '[object Blob]';
+  return toString.call(val) === '[object Blob]';
 }
 
 /**
@@ -133,6 +153,8 @@ function merge(obj1/*, obj2, obj3, ...*/) {
 
 module.exports = {
   isArray: isArray,
+  isString: isString,
+  isNumber: isNumber,
   isObject: isObject,
   isDate: isDate,
   isFile: isFile,

test/specs/axios.spec.js

@@ -39,7 +39,9 @@ describe('axios', function () {
     });
 
     it('should default common headers', function () {
-      axios();
+      axios({
+        url: '/foo'
+      });
 
       var request = jasmine.Ajax.requests.mostRecent();
       var headers = axios.defaults.headers.common;
@@ -52,7 +54,12 @@ describe('axios', function () {
 
     it('should add extra headers for post', function () {
       axios({
-        method: 'post'
+        method: 'post',
+        url: '/foo',
+        data: {
+          firstName: 'foo',
+          lastName: 'bar'
+        }
       });
 
       var request = jasmine.Ajax.requests.mostRecent();
@@ -63,6 +70,16 @@ describe('axios', function () {
         }
       }
     });
+
+    it('should remove content-type if data is empty', function () {
+      axios({
+        method: 'post',
+        url: '/foo'
+      });
+
+      var request = jasmine.Ajax.requests.mostRecent();
+      expect(request.requestHeaders['content-type']).toEqual(undefined);
+    });
   });
 
   describe('options', function () {
@@ -71,7 +88,9 @@ describe('axios', function () {
     });
 
     it('should default method to get', function () {
-      axios();
+      axios({
+        url: '/foo'
+      });
 
       var request = jasmine.Ajax.requests.mostRecent();
       expect(request.method).toBe('get');
@@ -79,6 +98,7 @@ describe('axios', function () {
 
     it('should accept headers', function () {
       axios({
+        url: '/foo',
         headers: {
           'X-Requested-With': 'XMLHttpRequest'
         }
@@ -103,6 +123,7 @@ describe('axios', function () {
 
     it('should allow overriding default headers', function () {
       axios({
+        url: '/foo',
         headers: {
           'Accept': 'foo/bar'
         }
@@ -112,4 +133,29 @@ describe('axios', function () {
       expect(request.requestHeaders['Accept']).toEqual('foo/bar');
     });
   });
+
+  describe('xsrf', function () {
+    afterEach(function () {
+      document.cookie = axios.defaults.xsrfCookieName + '=;expires=' + new Date(Date.now() - 86400000).toGMTString();
+    });
+
+    it('should not set xsrf header if cookie is null', function () {
+      axios({
+        url: '/foo'
+      });
+
+      var request = jasmine.Ajax.requests.mostRecent();
+      expect(request.requestHeaders[axios.defaults.xsrfHeaderName]).toEqual(undefined);
+    });
+
+    it('should set xsrf header if cookie is set', function () {
+      document.cookie = axios.defaults.xsrfCookieName + '=12345';
+      axios({
+        url: '/foo'
+      });
+
+      var request = jasmine.Ajax.requests.mostRecent();
+      expect(request.requestHeaders[axios.defaults.xsrfHeaderName]).toEqual('12345');
+    });
+  });
 });

test/unit/utils/isX.js

@@ -7,6 +7,18 @@ module.exports = {
     test.done();
   },
 
+  testIsString: function (test) {
+    test.equals(utils.isString(''), true);
+    test.equals(utils.isString({toString: function () { return ''; }}), false);
+    test.done();
+  },
+
+  testIsNumber: function (test) {
+    test.equals(utils.isNumber(123), true);
+    test.equals(utils.isNumber('123'), false);
+    test.done();
+  },
+
   testIsObject: function (test) {
     test.equals(utils.isObject({}), true);
     test.equals(utils.isObject(null), false);