Module | ActionController::RequestForgeryProtection |
In: |
vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb
|
# File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 6 6: def self.included(base) 7: base.class_eval do 8: class_inheritable_accessor :request_forgery_protection_options 9: self.request_forgery_protection_options = {} 10: helper_method :form_authenticity_token 11: helper_method :protect_against_forgery? 12: end 13: base.extend(ClassMethods) 14: end
No secret was given, so assume this is a cookie session store.
# File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 123 123: def authenticity_token_from_cookie_session 124: session[:csrf_id] ||= CGI::Session.generate_unique_id 125: session.dbman.generate_digest(session[:csrf_id]) 126: end
Generates a unique digest using the session_id and the CSRF secret.
# File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 112 112: def authenticity_token_from_session_id 113: key = if request_forgery_protection_options[:secret].respond_to?(:call) 114: request_forgery_protection_options[:secret].call(@session) 115: else 116: request_forgery_protection_options[:secret] 117: end 118: digest = request_forgery_protection_options[:digest] ||= 'SHA1' 119: OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new(digest), key.to_s, session.session_id.to_s) 120: end
Sets the token value for the current session. Pass a :secret option in protect_from_forgery to add a custom salt to the hash.
# File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 99 99: def form_authenticity_token 100: @form_authenticity_token ||= if request_forgery_protection_options[:secret] 101: authenticity_token_from_session_id 102: elsif session.respond_to?(:dbman) && session.dbman.respond_to?(:generate_digest) 103: authenticity_token_from_cookie_session 104: elsif session.nil? 105: raise InvalidAuthenticityToken, "Request Forgery Protection requires a valid session. Use #allow_forgery_protection to disable it, or use a valid session." 106: else 107: raise InvalidAuthenticityToken, "No :secret given to the #protect_from_forgery call. Set that or use a session store capable of generating its own keys (Cookie Session Store)." 108: end 109: end
# File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 128 128: def protect_against_forgery? 129: allow_forgery_protection && request_forgery_protection_token 130: end
# File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 94 94: def verifiable_request_format? 95: request.format.html? || request.format.js? 96: end
Returns true or false if a request is verified. Checks:
# File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 87 87: def verified_request? 88: !protect_against_forgery? || 89: request.method == :get || 90: !verifiable_request_format? || 91: form_authenticity_token == params[request_forgery_protection_token] 92: end
The actual before_filter that is used. Modify this to change how you handle unverified requests.
# File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 78 78: def verify_authenticity_token 79: verified_request? || raise(ActionController::InvalidAuthenticityToken) 80: end