Module: ActionController::RequestForgeryProtection

Extended by:

ActiveSupport::Concern

Includes:

AbstractController::Callbacks, AbstractController::Helpers

Included in:

Base

Defined in:

lib/action_controller/metal/request_forgery_protection.rb

Overview

# Action Controller Request Forgery Protection

Controller actions are protected from Cross-Site Request Forgery (CSRF) attacks by including a token in the rendered HTML for your application. This token is stored as a random string in the session, to which an attacker does not have access. When a request reaches your application, Rails verifies the received token with the token in the session. All requests are checked except GET requests as these should be idempotent. Keep in mind that all session-oriented requests are CSRF protected by default, including JavaScript and HTML requests.

Since HTML and JavaScript requests are typically made from the browser, we need to ensure to verify request authenticity for the web browser. We can use session-oriented authentication for these types of requests, by using the ‘protect_from_forgery` method in our controllers.

GET requests are not protected since they don’t have side effects like writing to the database and don’t leak sensitive information. JavaScript requests are an exception: a third-party site can use a <script> tag to reference a JavaScript URL on your site. When your JavaScript response loads on their site, it executes. With carefully crafted JavaScript on their end, sensitive data in your JavaScript response may be extracted. To prevent this, only XmlHttpRequest (known as XHR or Ajax) requests are allowed to make requests for JavaScript responses.

Subclasses of ActionController::Base are protected by default with the ‘:exception` strategy, which raises an ActionController::InvalidAuthenticityToken error on unverified requests.

APIs may want to disable this behavior since they are typically designed to be state-less: that is, the request API client handles the session instead of Rails. One way to achieve this is to use the ‘:null_session` strategy instead, which allows unverified requests to be handled, but with an empty session:

class ApplicationController < ActionController::Base
  protect_from_forgery with: :null_session
end

Note that API only applications don’t include this module or a session middleware by default, and so don’t require CSRF protection to be configured.

The token parameter is named ‘authenticity_token` by default. The name and value of this token must be added to every layout that renders forms by including `csrf_meta_tags` in the HTML `head`.

Learn more about CSRF attacks and securing your application in the [Ruby on Rails Security Guide](guides.rubyonrails.org/security.html).

Defined Under Namespace

Modules: ClassMethods, ProtectionMethods Classes: CookieStore, SessionStore

Constant Summary

CSRF_TOKEN =

"action_controller.csrf_token"

Instance Method Summary

• #commit_csrf_token(request) ⇒ Object

  :doc:.

• #initialize ⇒ Object
• #reset_csrf_token(request) ⇒ Object

  :doc:.

Methods included from AbstractController::Helpers

#_helpers

Methods included from AbstractController::Helpers::Resolution

#all_helpers_from_path, #helper_modules_from_paths, #modules_for_helpers

Instance Method Details

#commit_csrf_token(request) ⇒ Object

:doc:

# File 'lib/action_controller/metal/request_forgery_protection.rb', line 374

def commit_csrf_token(request) # :doc:
  csrf_token = request.env[CSRF_TOKEN]
  csrf_token_storage_strategy.store(request, csrf_token) unless csrf_token.nil?
end

#initialize ⇒ Object

# File 'lib/action_controller/metal/request_forgery_protection.rb', line 364

def initialize(...)
  super
  @_marked_for_same_origin_verification = nil
end

#reset_csrf_token(request) ⇒ Object

:doc:

# File 'lib/action_controller/metal/request_forgery_protection.rb', line 369

def reset_csrf_token(request) # :doc:
  request.env.delete(CSRF_TOKEN)
  csrf_token_storage_strategy.reset(request)
end