Class: Rack::Protection::AuthenticityToken

Inherits:
Base
  • Object
show all
Defined in:
lib/rack/protection/authenticity_token.rb

Overview

Prevented attack

CSRF

Supported browsers

all

More infos

en.wikipedia.org/wiki/Cross-site_request_forgery

Only accepts unsafe HTTP requests if a given access token matches the token included in the session.

Compatible with Rails and rack-csrf.

Direct Known Subclasses

FormToken, RemoteToken

Constant Summary

Constants inherited from Base

Base::DEFAULT_OPTIONS

Instance Attribute Summary

Attributes inherited from Base

#app, #options

Instance Method Summary collapse

Methods inherited from Base

#call, #default_options, default_options, default_reaction, #deny, #drop_session, #encrypt, #initialize, #random_string, #react, #referrer, #safe?, #session, #session?, #warn

Constructor Details

This class inherits a constructor from Rack::Protection::Base

Instance Method Details

#accepts?(env) ⇒ Boolean

Returns:

  • (Boolean) 


15
16
17
18
19
20
21
 
# File 'lib/rack/protection/authenticity_token.rb', line 15

def accepts?(env)
  return true if safe? env
  session = session env
  token   = session[:csrf] ||= session['_csrf_token'] || random_string
  env['HTTP_X_CSRF_TOKEN'] == token or
    Request.new(env).params['authenticity_token'] == token
end