Class: Rack::Protection::FormToken
- Inherits:
-
AuthenticityToken
- Object
- Base
- AuthenticityToken
- Rack::Protection::FormToken
- Defined in:
- lib/rubypitaya/app-template/vendor/bundle/ruby/3.1.0/gems/rack-protection-3.0.5/lib/rack/protection/form_token.rb
Overview
- Prevented attack
-
CSRF
- Supported browsers
-
all
- More infos
Only accepts submitted forms if a given access token matches the token included in the session. Does not expect such a token from Ajax request.
This middleware is not used when using the Rack::Protection collection, since it might be a security issue, depending on your application
Compatible with rack-csrf.
Constant Summary
Constants inherited from AuthenticityToken
AuthenticityToken::TOKEN_LENGTH
Constants inherited from Base
Instance Attribute Summary
Attributes inherited from Base
Instance Method Summary collapse
Methods inherited from AuthenticityToken
#mask_authenticity_token, random_token, token
Methods inherited from Base
#call, #default_options, default_options, default_reaction, #deny, #drop_session, #encrypt, #html?, #initialize, #instrument, #origin, #random_string, #react, #referrer, #report, #safe?, #secure_compare, #session, #session?, #warn
Constructor Details
This class inherits a constructor from Rack::Protection::Base
Instance Method Details
#accepts?(env) ⇒ Boolean
20 21 22 |
# File 'lib/rubypitaya/app-template/vendor/bundle/ruby/3.1.0/gems/rack-protection-3.0.5/lib/rack/protection/form_token.rb', line 20 def accepts?(env) env['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest' or super end |