Class: Omniauth::Protect::Validator

Inherits:
Object
  • Object
show all
Defined in:
lib/omniauth/protect/validator.rb

Instance Method Summary collapse

Constructor Details

#initialize(env, encoded_masked_token) ⇒ Validator

Returns a new instance of Validator.



6
7
8
9
 
# File 'lib/omniauth/protect/validator.rb', line 6

def initialize(env, encoded_masked_token)
  @session = env['rack.session']
  @encoded_masked_token = encoded_masked_token
end

Instance Method Details

#valid_csrf_token? ⇒ Boolean

This is mostly taken & adapted from Rails’ action_controller/metal/request_forgery_protection.rb We copy code from Rails in such a horrible manner because Rails doesn’t really expose CSRF protection

Returns:

  • (Boolean) 


13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
 
# File 'lib/omniauth/protect/validator.rb', line 13

def valid_csrf_token?
  begin
    masked_token = Base64.urlsafe_decode64(@encoded_masked_token)
  rescue ArgumentError # @encoded_masked_token is invalid Base64
    return false
  end

  token_length = ActionController::RequestForgeryProtection::AUTHENTICITY_TOKEN_LENGTH

  if masked_token.length == token_length * 2
    csrf_token = unmask_token(masked_token, token_length)

    real_token = real_csrf_token(token_length)
    global_token = global_csrf_token(real_token)

    compare_tokens(csrf_token, real_token) || compare_tokens(csrf_token, global_token)
  end
end