Module: ActionController::RequestForgeryProtection
- Extended by:
- ActiveSupport::Concern
- Defined in:
- lib/action_controller/metal/request_forgery_protection.rb
Overview
Controller actions are protected from Cross-Site Request Forgery (CSRF) attacks by including a token in the rendered HTML for your application. This token is stored as a random string in the session, to which an attacker does not have access. When a request reaches your application, Rails verifies the received token with the token in the session. All requests are checked except GET requests as these should be idempotent. Keep in mind that all session-oriented requests are CSRF protected by default, including JavaScript and HTML requests.
Since HTML and JavaScript requests are typically made from the browser, we need to ensure to verify request authenticity for the web browser. We can use session-oriented authentication for these types of requests, by using the protect_from_forgery method in our controllers.
GET requests are not protected since they don’t have side effects like writing to the database and don’t leak sensitive information. JavaScript requests are an exception: a third-party site can use a <script> tag to reference a JavaScript URL on your site. When your JavaScript response loads on their site, it executes. With carefully crafted JavaScript on their end, sensitive data in your JavaScript response may be extracted. To prevent this, only XmlHttpRequest (known as XHR or Ajax) requests are allowed to make requests for JavaScript responses.
It’s important to remember that XML or JSON requests are also checked by default. If you’re building an API or an SPA you could change forgery protection method in ApplicationController (by default: :exception):
class ApplicationController < ActionController::Base
protect_from_forgery unless: -> { request.format.json? }
end
It is generally safe to exclude XHR requests from CSRF protection (like the code snippet above does), because XHR requests can only be made from the same origin. Note however that any cross-origin third party domain allowed via CORS will also be able to create XHR requests. Be sure to check your CORS configuration before disabling forgery protection for XHR.
CSRF protection is turned on with the protect_from_forgery method. By default protect_from_forgery protects your session with :null_session method, which provides an empty session during request.
We may want to disable CSRF protection for APIs since they are typically designed to be state-less. That is, the request API client will handle the session for you instead of Rails.
The token parameter is named authenticity_token by default. The name and value of this token must be added to every layout that renders forms by including csrf_meta_tags in the HTML head.
Learn more about CSRF attacks and securing your application in the Ruby on Rails Security Guide.
Defined Under Namespace
Modules: ClassMethods, ProtectionMethods