angularjs - 为什么 AngularJS 将 X-XSRF-TOKEN header 作为 JSON 字符串发送？

Question

Angular sets the X-XSRF-TOKEN header to the value of the XSRF-TOKEN cookie:

var xsrfValue = isSameDomain(config.url, $browser.url())
                ? $browser.cookies()[config.xsrfCookieName || defaults.xsrfCookieName]
                : undefined;
if (xsrfValue) {
  headers[(config.xsrfHeaderName || defaults.xsrfHeaderName)] = xsrfValue;
}

但是，如果设置了 XSRF-TOKEN cookie 使用 $cookieStore (例如，对于 Rails 集成):

$cookieStore.put("XSRF-TOKEN", "my_token"); 

the cookie is stored as JSON string:

put: function(key, value) {
  $cookies[key] = angular.toJson(value);
}

这意味着标题将有额外的双引号:

X-XSRF-TOKEN    "my_token"

为什么 Angular 不调用 fromJson() 当它设置标题的值时，标题将如下所示:

X-XSRF-TOKEN    my_token

?

这将使我们免于删除服务器端额外的双引号。

我在这里遗漏了一些明显的东西吗？

注:我不是在寻找解决方法。我试图了解这种行为是否是预期的行为，如果是，理由是什么？

Answer 1

Here is the official answer I got:

The real problem here is that you are trying to use the $cookieStore for the wrong purpose. The $cookieStore is an abstraction on top of $cookie, which works with objects and serializes them to JSON. If you want to assign the XSRF token then just use $cookie to write it, which works directly with strings.

换句话说，你应该这样做:

$cookies["XSRF-TOKEN"] = "my_token"; // Stored as: my_token

而不是:

$cookieStore.put("XSRF-TOKEN", "my_token"); // Stored as: "my_token"