Class: Rack::Protection::FormToken

Inherits:
AuthenticityToken show all
Defined in:
lib/rack/protection/form_token.rb

Overview

Prevented attack

CSRF

Supported browsers

all

More infos

en.wikipedia.org/wiki/Cross-site_request_forgery

Only accepts submitted forms if a given access token matches the token included in the session. Does not expect such a token from Ajax request.

This middleware is not used when using the Rack::Protection collection, since it might be a security issue, depending on your application

Compatible with rack-csrf.

Constant Summary

Constants inherited from AuthenticityToken

AuthenticityToken::TOKEN_LENGTH

Constants inherited from Base

Base::DEFAULT_OPTIONS

Instance Attribute Summary

Attributes inherited from Base

#app, #options

Instance Method Summary collapse

Methods inherited from AuthenticityToken

#mask_authenticity_token, random_token, token

Methods inherited from Base

#call, #debug, #default_options, default_options, default_reaction, #deny, #drop_session, #encrypt, #html?, #initialize, #instrument, #origin, #random_string, #react, #referrer, #report, #safe?, #secure_compare, #session, #session?, #warn

Constructor Details

This class inherits a constructor from Rack::Protection::Base

Instance Method Details

#accepts?(env) ⇒ Boolean

Returns:

  • (Boolean) 


20
21
22
 
# File 'lib/rack/protection/form_token.rb', line 20

def accepts?(env)
  env['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest' or super
end