Module: ActionController::RequestForgeryProtection::ClassMethods
- Defined in:
- lib/action_controller/metal/request_forgery_protection.rb
Instance Method Summary collapse
-
#protect_from_forgery(options = {}) ⇒ Object
Turn on request forgery protection.
Instance Method Details
#protect_from_forgery(options = {}) ⇒ Object
Turn on request forgery protection. Bear in mind that only non-GET, HTML/JavaScript requests are checked.
class ApplicationController < ActionController::Base
protect_from_forgery
end
class FooController < ApplicationController
protect_from_forgery except: :index
You can disable CSRF protection on controller by skipping the verification before_action:
skip_before_action :verify_authenticity_token
Valid Options:
-
:only/:except
- Passed to thebefore_action
call. Set which actions are verified. -
:with
- Set the method to handle unverified request.
Valid unverified request handling methods are:
-
:exception
- Raises ActionController::InvalidAuthenticityToken exception. -
:reset_session
- Resets the session. -
:null_session
- Provides an empty session during request but doesn’t reset it completely. Used as default if:with
option is not specified.
97 98 99 100 101 102 |
# File 'lib/action_controller/metal/request_forgery_protection.rb', line 97 def protect_from_forgery( = {}) self.forgery_protection_strategy = protection_method_class([:with] || :null_session) self.request_forgery_protection_token ||= :authenticity_token prepend_before_action :verify_authenticity_token, append_after_action :verify_same_origin_request end |