ActionController::RequestForgeryProtection

Controller actions are protected from Cross-Site Request Forgery (CSRF) attacks by including a token in the rendered html for your application. This token is stored as a random string in the session, to which an attacker does not have access. When a request reaches your application, Rails verifies the received token with the token in the session. Only HTML and JavaScript requests are checked, so this will not protect your XML API (presumably you’ll have a different authentication scheme there anyway). Also, GET requests are not protected as these should be idempotent.

CSRF protection is turned on with the protect_from_forgery method, which checks the token and resets the session if it doesn’t match what was expected. A call to this method is generated for new Rails applications by default.

The token parameter is named authenticity_token by default. The name and value of this token must be added to every layout that renders forms by including csrf_meta_tags in the html head.

Learn more about CSRF attacks and securing your application in the Ruby on Rails Security Guide.

Namespace

MODULE ActionController::RequestForgeryProtection::ClassMethods

Methods

F

form_authenticity_param,
form_authenticity_token

H

handle_unverified_request

P

protect_against_forgery?

V

verified_request?,
verify_authenticity_token

Included Modules

Instance Protected methods

form_authenticity_param()

The form’s authenticity parameter. Override to provide your own.

Source: show | on GitHub

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 118
def form_authenticity_param
  params[request_forgery_protection_token]
end

form_authenticity_token()

Sets the token value for the current session.

Source: show | on GitHub

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 113
def form_authenticity_token
  session[:_csrf_token] ||= SecureRandom.base64(32)
end

handle_unverified_request()

This is the method that defines the application behavior when a request is found to be unverified. By default, Rails uses request_forgery_protection_method when it finds an unverified request:

:reset_session - Resets the session.
:exception: - Raises ActionController::InvalidAuthenticityToken exception.

Source: show | on GitHub

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 90
def handle_unverified_request
  case request_forgery_protection_method
  when :exception
    raise ActionController::InvalidAuthenticityToken
  when :reset_session
    reset_session
  else
    raise ArgumentError, 'Invalid request forgery protection method, use :exception or :reset_session'
  end
end

protect_against_forgery?()

Source: show | on GitHub

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 122
def protect_against_forgery?
  allow_forgery_protection
end

verified_request?()

Returns true or false if a request is verified. Checks:

is it a GET request? Gets should be safe and idempotent
Does the #form_authenticity_token match the given token value from the params?
Does the X-CSRF-Token header match the #form_authenticity_token

Source: show | on GitHub

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 106
def verified_request?
  !protect_against_forgery? || request.get? ||
    form_authenticity_token == params[request_forgery_protection_token] ||
    form_authenticity_token == request.headers['X-CSRF-Token']
end

verify_authenticity_token()

The actual before_filter that is used. Modify this to change how you handle unverified requests.

Source: show | on GitHub

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 78
def verify_authenticity_token
  unless verified_request?
    logger.warn "Can't verify CSRF token authenticity" if logger
    handle_unverified_request
  end
end

Module ActionController::RequestForgeryProtection