Module ActionController::RequestForgeryProtection
In: vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb

Methods

Classes and Modules

Module ActionController::RequestForgeryProtection::ClassMethods

Public Class methods

[Source]

    # File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 6
 6:     def self.included(base)
 7:       base.class_eval do
 8:         class_inheritable_accessor :request_forgery_protection_options
 9:         self.request_forgery_protection_options = {}
10:         helper_method :form_authenticity_token
11:         helper_method :protect_against_forgery?
12:       end
13:       base.extend(ClassMethods)
14:     end

Protected Instance methods

No secret was given, so assume this is a cookie session store.

[Source]

     # File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 123
123:       def authenticity_token_from_cookie_session
124:         session[:csrf_id] ||= CGI::Session.generate_unique_id
125:         session.dbman.generate_digest(session[:csrf_id])
126:       end

Generates a unique digest using the session_id and the CSRF secret.

[Source]

     # File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 112
112:       def authenticity_token_from_session_id
113:         key = if request_forgery_protection_options[:secret].respond_to?(:call)
114:           request_forgery_protection_options[:secret].call(@session)
115:         else
116:           request_forgery_protection_options[:secret]
117:         end
118:         digest = request_forgery_protection_options[:digest] ||= 'SHA1'
119:         OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new(digest), key.to_s, session.session_id.to_s)
120:       end

Sets the token value for the current session. Pass a :secret option in protect_from_forgery to add a custom salt to the hash.

[Source]

     # File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 99
 99:       def form_authenticity_token
100:         @form_authenticity_token ||= if request_forgery_protection_options[:secret]
101:           authenticity_token_from_session_id
102:         elsif session.respond_to?(:dbman) && session.dbman.respond_to?(:generate_digest)
103:           authenticity_token_from_cookie_session
104:         elsif session.nil?
105:           raise InvalidAuthenticityToken, "Request Forgery Protection requires a valid session.  Use #allow_forgery_protection to disable it, or use a valid session."
106:         else
107:           raise InvalidAuthenticityToken, "No :secret given to the #protect_from_forgery call.  Set that or use a session store capable of generating its own keys (Cookie Session Store)."
108:         end
109:       end

[Source]

     # File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 128
128:       def protect_against_forgery?
129:         allow_forgery_protection && request_forgery_protection_token
130:       end

[Source]

    # File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 94
94:       def verifiable_request_format?
95:         request.format.html? || request.format.js?
96:       end

Returns true or false if a request is verified. Checks:

  • is the format restricted? By default, only HTML and AJAX requests are checked.
  • is it a GET request? Gets should be safe and idempotent
  • Does the form_authenticity_token match the given _token value from the params?

[Source]

    # File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 87
87:       def verified_request?
88:         !protect_against_forgery?     ||
89:           request.method == :get      ||
90:           !verifiable_request_format? ||
91:           form_authenticity_token == params[request_forgery_protection_token]
92:       end

The actual before_filter that is used. Modify this to change how you handle unverified requests.

[Source]

    # File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 78
78:       def verify_authenticity_token
79:         verified_request? || raise(ActionController::InvalidAuthenticityToken)
80:       end

[Validate]