Decouple CSRF protection from the session machinery#2854

Merged

mmerickel merged 8 commits intoPylons:masterfrom MatthewWilkes:csrf_session_decouple

Apr 30, 2017

+988-500

Commits on Apr 12, 2017

Create a new ICSRF implementation for getting CSRF tokens, split out from the session machinery.
MatthewWilkes
committed
Fix tests and documentation in various places, and feedback following review

jcerjak
authored and
MatthewWilkes
committed
add to contributors list

jcerjak
authored and
MatthewWilkes
committed
Rename implementation to ICSRFStoragePolicy
MatthewWilkes
committed
Fix a bug where people that didn't configure CSRF protection but did configure a session and set explicit checks would see an exception
MatthewWilkes
committed
Use the webob CookieProfile in the Cookie implementation, rename some implemenations based on feedback, split CSRF implementation and option configuration and make the csrf token function exposed a…
MatthewWilkes
committed

Commits on Apr 26, 2017