| Module | ActionController::RequestForgeryProtection |
| In: |
vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb
|
# File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 6
6: def self.included(base)
7: base.class_eval do
8: class_inheritable_accessor :request_forgery_protection_options
9: self.request_forgery_protection_options = {}
10: helper_method :form_authenticity_token
11: helper_method :protect_against_forgery?
12: end
13: base.extend(ClassMethods)
14: end
No secret was given, so assume this is a cookie session store.
# File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 123
123: def authenticity_token_from_cookie_session
124: session[:csrf_id] ||= CGI::Session.generate_unique_id
125: session.dbman.generate_digest(session[:csrf_id])
126: end
Generates a unique digest using the session_id and the CSRF secret.
# File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 112
112: def authenticity_token_from_session_id
113: key = if request_forgery_protection_options[:secret].respond_to?(:call)
114: request_forgery_protection_options[:secret].call(@session)
115: else
116: request_forgery_protection_options[:secret]
117: end
118: digest = request_forgery_protection_options[:digest] ||= 'SHA1'
119: OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new(digest), key.to_s, session.session_id.to_s)
120: end
Sets the token value for the current session. Pass a :secret option in protect_from_forgery to add a custom salt to the hash.
# File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 99
99: def form_authenticity_token
100: @form_authenticity_token ||= if request_forgery_protection_options[:secret]
101: authenticity_token_from_session_id
102: elsif session.respond_to?(:dbman) && session.dbman.respond_to?(:generate_digest)
103: authenticity_token_from_cookie_session
104: elsif session.nil?
105: raise InvalidAuthenticityToken, "Request Forgery Protection requires a valid session. Use #allow_forgery_protection to disable it, or use a valid session."
106: else
107: raise InvalidAuthenticityToken, "No :secret given to the #protect_from_forgery call. Set that or use a session store capable of generating its own keys (Cookie Session Store)."
108: end
109: end
# File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 128
128: def protect_against_forgery?
129: allow_forgery_protection && request_forgery_protection_token
130: end
# File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 94
94: def verifiable_request_format?
95: request.format.html? || request.format.js?
96: end
Returns true or false if a request is verified. Checks:
# File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 87
87: def verified_request?
88: !protect_against_forgery? ||
89: request.method == :get ||
90: !verifiable_request_format? ||
91: form_authenticity_token == params[request_forgery_protection_token]
92: end
The actual before_filter that is used. Modify this to change how you handle unverified requests.
# File vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb, line 78
78: def verify_authenticity_token
79: verified_request? || raise(ActionController::InvalidAuthenticityToken)
80: end