Module: ActionController::RequestForgeryProtection
- Extended by:
- ActiveSupport::Concern
- Defined in:
- lib/action_controller/metal/request_forgery_protection.rb
Overview
Controller actions are protected from Cross-Site Request Forgery (CSRF) attacks by including a token in the rendered html for your application. This token is stored as a random string in the session, to which an attacker does not have access. When a request reaches your application, Rails verifies the received token with the token in the session. Only HTML and JavaScript requests are checked, so this will not protect your XML API (presumably you’ll have a different authentication scheme there anyway). Also, GET requests are not protected as these should be idempotent.
CSRF protection is turned on with the protect_from_forgery method, which checks the token and resets the session if it doesn’t match what was expected. A call to this method is generated for new Rails applications by default. You can customize the error message by editing public/422.html.
The token parameter is named authenticity_token by default. The name and value of this token must be added to every layout that renders forms by including csrf_meta_tags in the html head.
Learn more about CSRF attacks and securing your application in the Ruby on Rails Security Guide.
Defined Under Namespace
Modules: ClassMethods