Class: Rack::Protection::FormToken
- Inherits:
-
AuthenticityToken
- Object
- Base
- AuthenticityToken
- Rack::Protection::FormToken
- Defined in:
- lib/rack/protection/form_token.rb
Overview
- Prevented attack
-
CSRF
- Supported browsers
-
all
- More infos
Only accepts submitted forms if a given access token matches the token included in the session. Does not expect such a token from Ajax request.
This middleware is not used when using the Rack::Protection collection, since it might be a security issue, depending on your application
Compatible with Rails and rack-csrf.
Constant Summary
Constants inherited from Base
Instance Attribute Summary
Attributes inherited from Base
Instance Method Summary collapse
Methods inherited from Base
#bytesize, #call, #default_options, default_options, default_reaction, #deny, #drop_session, #encrypt, #html?, #initialize, #instrument, #origin, #random_string, #react, #referrer, #report, #safe?, #secure_compare, #session, #session?, #warn
Constructor Details
This class inherits a constructor from Rack::Protection::Base
Instance Method Details
#accepts?(env) ⇒ Boolean
18 19 20 |
# File 'lib/rack/protection/form_token.rb', line 18 def accepts?(env) env["HTTP_X_REQUESTED_WITH"] == "XMLHttpRequest" or super end |