Module: ActionController::RequestForgeryProtection

Extended by:
ActiveSupport::Concern
Includes:
AbstractController::Callbacks, AbstractController::Helpers
Included in:
Base
Defined in:
actionpack/lib/action_controller/metal/request_forgery_protection.rb

Overview

Action Controller Request Forgery Protection

Controller actions are protected from Cross-Site Request Forgery (CSRF) attacks by including a token in the rendered HTML for your application. This token is stored as a random string in the session, to which an attacker does not have access. When a request reaches your application, Rails verifies the received token with the token in the session. All requests are checked except GET requests as these should be idempotent. Keep in mind that all session-oriented requests are CSRF protected by default, including JavaScript and HTML requests.

Since HTML and JavaScript requests are typically made from the browser, we need to ensure to verify request authenticity for the web browser. We can use session-oriented authentication for these types of requests, by using the protect_from_forgery method in our controllers.

GET requests are not protected since they don't have side effects like writing to the database and don't leak sensitive information. JavaScript requests are an exception: a third-party site can use a

:doc:



374
375
376
377
 
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 374

def commit_csrf_token(request) # :doc:
  csrf_token = request.env[CSRF_TOKEN]
  csrf_token_storage_strategy.store(request, csrf_token) unless csrf_token.nil?
end

#initialize ⇒ Object 



364
365
366
367
 
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 364

def initialize(...)
  super
  @_marked_for_same_origin_verification = nil
end

#reset_csrf_token(request) ⇒ Object

:doc:



369
370
371
372
 
# File 'actionpack/lib/action_controller/metal/request_forgery_protection.rb', line 369

def reset_csrf_token(request) # :doc:
  request.env.delete(CSRF_TOKEN)
  csrf_token_storage_strategy.reset(request)
end