Class: Rack::Protection::AuthenticityToken
- Defined in:
- lib/rack/protection/authenticity_token.rb
Overview
- Prevented attack
-
CSRF
- Supported browsers
-
all
- More infos
Only accepts unsafe HTTP requests if a given access token matches the token included in the session.
Compatible with Rails and rack-csrf.
Options:
authenticity_param: Defines the param’s name that should contain the token on a request.
Direct Known Subclasses
Constant Summary
Constants inherited from Base
Instance Attribute Summary
Attributes inherited from Base
Instance Method Summary collapse
Methods inherited from Base
#call, #default_options, default_options, default_reaction, #deny, #drop_session, #encrypt, #html?, #initialize, #instrument, #origin, #random_string, #react, #referrer, #report, #safe?, #session, #session?, #warn
Constructor Details
This class inherits a constructor from Rack::Protection::Base
Instance Method Details
#accepts?(env) ⇒ Boolean
22 23 24 25 26 27 28 |
# File 'lib/rack/protection/authenticity_token.rb', line 22 def accepts?(env) session = session env token = session[:csrf] ||= session['_csrf_token'] || random_string safe?(env) || env['HTTP_X_CSRF_TOKEN'] == token || Request.new(env).params[[:authenticity_param]] == token end |