commit 5ee0ee65bb10510428d6f126cc08ce85ab4db307
author Suharsh Sivakumar <suharshs@google.com> Thu Sep 04 13:16:34 2014 -0700
committer Suharsh Sivakumar <suharshs@google.com> Thu Sep 04 13:16:38 2014 -0700
tree 3a46c8f2d8da155d8513e659a1a1621ff3ecb77a
parent f89d965fa6da0fcfe503342160e25105c8e56513

veyron/services/identity: Adding CSRF protection to revocation interface in
identity server.

* Tokens are embedded into JS on page load.
* Server validates that token against the request's cookie.
* Server also checks that token matches one of the caveatIDs that the user can
  revoke based on a map that is stored in memory.

Future:
* Consider a timeout on entries in the DirectoryStore.
* Ensure that tokens are refreshed frequently enough to ensure that this works.

Change-Id: If7ca60ed9cd2695592cf575657fe406dc29bbf7c