RFC 6648: SHOULD NOT prefix their parameter names with "X-"

[expressjs]

RFC 6648: SHOULD NOT prefix their parameter names with "X-"

[gabeio]

I would have to agree that looking at xsrf-token and csrf-token headers for the tokens also would be nice. or give the option to give your own header so it can be whatever the user wishes.

[gabeio]

@arty-name though that only recommends against using x- therefore it's up to the expressjs team.

[arty-name]

@gabeio could you also update readme in your PR?

[gabeio]

added

[arty-name]

thanks! 👍

[gabeio]

also added tests

[dougwilson]

In the meantime, you can pass in your own function for the value option if you need non-x-headers.

[arty-name]

Yes, but I'm striving for reasonable defaults too :)

[dougwilson]

Ok, this sounds fine to me, especially with RFC 6648

[dougwilson]

@arty-name published as 1.7.0

[arty-name]

Thank you @dougwilson!