edge badge

Controller actions are protected from Cross-Site Request Forgery (CSRF) attacks by including a token in the rendered HTML for your application. This token is stored as a random string in the session, to which an attacker does not have access. When a request reaches your application, Rails verifies the received token with the token in the session. Only HTML and JavaScript requests are checked, so this will not protect your XML API (presumably you'll have a different authentication scheme there anyway).

GET requests are not protected since they don't have side effects like writing to the database and don't leak sensitive information. JavaScript requests are an exception: a third-party site can use a <script> tag to reference a JavaScript URL on your site. When your JavaScript response loads on their site, it executes. With carefully crafted JavaScript on their end, sensitive data in your JavaScript response may be extracted. To prevent this, only XmlHttpRequest (known as XHR or Ajax) requests are allowed to make GET requests for JavaScript responses.

It's important to remember that XML or JSON requests are also affected and if you're building an API you'll need something like:

class ApplicationController < ActionController::Base
  protect_from_forgery
  skip_before_action :verify_authenticity_token, if: :json_request?

  protected

  def json_request?
    request.format.json?
  end
end

CSRF protection is turned on with the protect_from_forgery method, which checks the token and resets the session if it doesn't match what was expected. A call to this method is generated for new Rails applications by default.

The token parameter is named authenticity_token by default. The name and value of this token must be added to every layout that renders forms by including csrf_meta_tags in the HTML head.

Learn more about CSRF attacks and securing your application in the Ruby on Rails Security Guide.

Namespace
Methods
C
F
H
M
N
P
R
V
X
Included Modules
Constants
CROSS_ORIGIN_JAVASCRIPT_WARNING = "Security warning: an embedded " \ "<script> tag on another site requested protected JavaScript. " \ "If you know what you're doing, go ahead and disable forgery " \ "protection on this action to permit cross-origin JavaScript embedding."
 
AUTHENTICITY_TOKEN_LENGTH = 32
 
Instance Protected methods
compare_with_real_token(token, session)
# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 308
def compare_with_real_token(token, session)
  ActiveSupport::SecurityUtils.secure_compare(token, real_csrf_token(session))
end
form_authenticity_param()

The form's authenticity parameter. Override to provide your own.

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 322
def form_authenticity_param
  params[request_forgery_protection_token]
end
form_authenticity_token()

Sets the token value for the current session.

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 258
def form_authenticity_token
  masked_authenticity_token(session)
end
handle_unverified_request()
# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 208
def handle_unverified_request
  forgery_protection_strategy.new(self).handle_unverified_request
end
mark_for_same_origin_verification!()

GET requests are checked for cross-origin JavaScript after rendering.

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 229
def mark_for_same_origin_verification!
  @marked_for_same_origin_verification = request.get?
end
marked_for_same_origin_verification?()

If the `verify_authenticity_token` before_action ran, verify that JavaScript responses are only served to same-origin GET requests.

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 235
def marked_for_same_origin_verification?
  @marked_for_same_origin_verification ||= false
end
masked_authenticity_token(session)

Creates a masked version of the authenticity token that varies on each request. The masking is used to mitigate SSL attacks like BREACH.

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 265
def masked_authenticity_token(session)
  one_time_pad = SecureRandom.random_bytes(AUTHENTICITY_TOKEN_LENGTH)
  encrypted_csrf_token = xor_byte_strings(one_time_pad, real_csrf_token(session))
  masked_token = one_time_pad + encrypted_csrf_token
  Base64.strict_encode64(masked_token)
end
non_xhr_javascript_response?()

Check for cross-origin JavaScript responses.

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 240
def non_xhr_javascript_response?
  content_type =~ %r(\Atext/javascript) && !request.xhr?
end
protect_against_forgery?()

Checks if the controller allows forgery protection.

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 327
def protect_against_forgery?
  allow_forgery_protection
end
real_csrf_token(session)
# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 312
def real_csrf_token(session)
  session[:_csrf_token] ||= SecureRandom.base64(AUTHENTICITY_TOKEN_LENGTH)
  Base64.strict_decode64(session[:_csrf_token])
end
valid_authenticity_token?(session, encoded_masked_token)

Checks the client's masked token to see if it matches the session token. Essentially the inverse of masked_authenticity_token.

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 275
def valid_authenticity_token?(session, encoded_masked_token)
  return false if encoded_masked_token.nil? || encoded_masked_token.empty?

  begin
    masked_token = Base64.strict_decode64(encoded_masked_token)
  rescue ArgumentError # encoded_masked_token is invalid Base64
    return false
  end

  # See if it's actually a masked token or not. In order to
  # deploy this code, we should be able to handle any unmasked
  # tokens that we've issued without error.

  if masked_token.length == AUTHENTICITY_TOKEN_LENGTH
    # This is actually an unmasked token. This is expected if
    # you have just upgraded to masked tokens, but should stop
    # happening shortly after installing this gem
    compare_with_real_token masked_token, session

  elsif masked_token.length == AUTHENTICITY_TOKEN_LENGTH * 2
    # Split the token into the one-time pad and the encrypted
    # value and decrypt it
    one_time_pad = masked_token[0...AUTHENTICITY_TOKEN_LENGTH]
    encrypted_csrf_token = masked_token[AUTHENTICITY_TOKEN_LENGTH..-1]
    csrf_token = xor_byte_strings(one_time_pad, encrypted_csrf_token)

    compare_with_real_token csrf_token, session

  else
    false # Token is malformed
  end
end
verified_request?()

Returns true or false if a request is verified. Checks:

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 251
def verified_request?
  !protect_against_forgery? || request.get? || request.head? ||
    valid_authenticity_token?(session, form_authenticity_param) ||
    valid_authenticity_token?(session, request.headers['X-CSRF-Token'])
end
verify_authenticity_token()

The actual before_action that is used to verify the CSRF token. Don't override this directly. Provide your own forgery protection strategy instead. If you override, you'll disable same-origin `<script>` verification.

Lean on the protect_from_forgery declaration to mark which actions are due for same-origin request verification. If protect_from_forgery is enabled on an action, this before_action flags its after_action to verify that JavaScript responses are for XHR requests, ensuring they follow the browser's same-origin policy.

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 197
def verify_authenticity_token
  mark_for_same_origin_verification!

  if !verified_request?
    if logger && log_warning_on_csrf_failure
      logger.warn "Can't verify CSRF token authenticity"
    end
    handle_unverified_request
  end
end
verify_same_origin_request()

If `verify_authenticity_token` was run (indicating that we have forgery protection enabled for this request) then also verify that we aren't serving an unauthorized cross-origin response.

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 221
def verify_same_origin_request
  if marked_for_same_origin_verification? && non_xhr_javascript_response?
    logger.warn CROSS_ORIGIN_JAVASCRIPT_WARNING if logger
    raise ActionController::InvalidCrossOriginRequest, CROSS_ORIGIN_JAVASCRIPT_WARNING
  end
end
xor_byte_strings(s1, s2)
# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 317
def xor_byte_strings(s1, s2)
  s1.bytes.zip(s2.bytes).map { |(c1,c2)| c1 ^ c2 }.pack('c*')
end