CSRF not support?!

[grapemix]

I was trying to run the sample setup, most stuff is working, but not CSRF. I am using django and restangular. By default, CSRF is enable for django and restangular. Restangular or other post request will automatically pick up the CSRF token and attached to every post request for my current setup. However, ng-flow is not the case. CSRF(http://en.wikipedia.org/wiki/Cross-site_request_forgery) is important, website without CSRF is un-secure. ng-flow user will suffer if ng-flow is not supporting CSRF. Currently, one of my site's api entry is disabling CSRF just for ng-flow. Will you support CSRF in the future? Thanks.
Here is my setup:
angular.module('app', [
'restangular',
])
.config( function(
$httpProvider
){
$httpProvider.defaults.xsrfCookieName = 'csrftoken';
$httpProvider.defaults.xsrfHeaderName = 'X-CSRFToken';
});
Let me know if you need more information. Thx.

[AidasK]

Flow.js does not use $http service, because of this you have to set csrf token manually to each request.
Flow.js allows to to set custom headers and parameters for each request.

https://github.com/flowjs/flow.js#configuration

Set function to a headers option:

{ 
  headers: function (file, chunk, isTest) {
    return {
        'X-CSRFToken': cookie.get("csrftoken")// call func for getting a cookie
    }
  }
}

Hope this solves your issue

[grapemix]

Sorry to reply so late. If I understand correctly, the headers is being assigned to the flowFactoryProvider which lived in the Module.cofig block. However, I cannot get my cookie in the config block because the config block only able to inject provider, but not instance. And the cookie provider is usually being placed in the run block because of the nature of the cookie provider. So I guess no 1 line solution in here.

In my case, I switch to use CORS, in the case, ng-flow and django works perfectly. Thanks for your follow up.

[AidasK]

No, you can pass headers in any place you want (for ex.: flow-init).

It seems my flow factory logic is too simple here:
https://github.com/flowjs/ng-flow/blob/master/src/provider.js#L24

Instead of this, we could pass service name, which creates flow instance and then needed, user should override existing service or create new one.