Why does `verify_csrf_token` return a promise?
Closed this issue · 1 comments
cemerick commented
The entire body of verify_csrf_token
is just wrapped in Lwt.return
, making me think that it could be made synchronous (and so somewhat less awkward to use).
Lines 40 to 82 in d418a79
aantron commented
It is for future-proofing, because a different CSRF token verification technique (for example, checking a cache or a database) might need I/O. If I/we become fully convinced that signed CSRF tokens are "always" good enough (at least as a default), we can drop the promise
from the signature. There might be other arguments for dropping it. Also, this might become less relevant once Dream is ported to effects, though I am not yet sure how the API will look.