module ActionController::RequestForgeryProtection - actionpack-4.2.4 Documentation

# module ActionController::RequestForgeryProtection

Controller actions are protected from Cross-Site Request Forgery (CSRF) attacks by including a token in the rendered HTML for your application. This token is stored as a random string in the session, to which an attacker does not have access. When a request reaches your application, Rails verifies the received token with the token in the session. Only HTML and JavaScript requests are checked, so this will not protect your XML API (presumably you'll have a different authentication scheme there anyway).

GET requests are not protected since they don't have side effects like writing to the database and don't leak sensitive information. JavaScript requests are an exception: a third-party site can use a <script> tag to reference a JavaScript URL on your site. When your JavaScript response loads on their site, it executes. With carefully crafted JavaScript on their end, sensitive data in your JavaScript response may be extracted. To prevent this, only XmlHttpRequest (known as XHR or Ajax) requests are allowed to make GET requests for JavaScript responses.

It's important to remember that XML or JSON requests are also affected and if you're building an API you'll need something like:

    class ApplicationController < ActionController::Base
      protect_from_forgery
      skip_before_action :verify_authenticity_token, if: :json_request?

      protected

      def json_request?
        request.format.json?
      end
    end

CSRF protection is turned on with the `protect_from_forgery` method, which checks the token and resets the session if it doesn't match what was expected. A call to this method is generated for new Rails applications by default.

The token parameter is named `authenticity_token` by default. The name and value of this token must be added to every layout that renders forms by including `csrf_meta_tags` in the HTML `head`.

Learn more about CSRF attacks and securing your application in the Ruby on Rails Security Guide.

### Protected Instance Methods

handle_unverified_request() click to toggle source

    # File lib/action_controller/metal/request_forgery_protection.rb, line 208
    def handle_unverified_request
      forgery_protection_strategy.new(self).handle_unverified_request
    end

verify_authenticity_token() click to toggle source

The actual before_action that is used to verify the CSRF token. Don't override this directly. Provide your own forgery protection strategy instead. If you override, you'll disable same-origin `<script>` verification.

Lean on the protect_from_forgery declaration to mark which actions are due for same-origin request verification. If protect_from_forgery is enabled on an action, this before_action flags its after_action to verify that JavaScript responses are for XHR requests, ensuring they follow the browser's same-origin policy.

    # File lib/action_controller/metal/request_forgery_protection.rb, line 197
    def verify_authenticity_token
      mark_for_same_origin_verification!

      if !verified_request?
        if logger && log_warning_on_csrf_failure
          logger.warn "Can't verify CSRF token authenticity"
        end
        handle_unverified_request
      end
    end