Class: Rack::Protection::AuthenticityToken
- Defined in:
- lib/rack/protection/authenticity_token.rb
Overview
- Prevented attack
-
CSRF
- Supported browsers
-
all
- More infos
Only accepts unsafe HTTP requests if a given access token matches the token included in the session.
Compatible with Rails and rack-csrf.
Direct Known Subclasses
Constant Summary
Constants inherited from Base
Instance Attribute Summary
Attributes inherited from Base
Instance Method Summary collapse
Methods inherited from Base
#call, #default_options, default_options, default_reaction, #deny, #drop_session, #encrypt, #initialize, #random_string, #react, #referrer, #safe?, #session, #session?, #warn
Constructor Details
This class inherits a constructor from Rack::Protection::Base
Instance Method Details
#accepts?(env) ⇒ Boolean
15 16 17 18 19 20 21 |
# File 'lib/rack/protection/authenticity_token.rb', line 15 def accepts?(env) return true if safe? env session = session env token = session[:csrf] ||= session['_csrf_token'] || random_string env['HTTP_X_CSRF_TOKEN'] == token or Request.new(env).params['authenticity_token'] == token end |