Controller actions are protected from Cross-Site Request Forgery (CSRF) attacks by including a token in the rendered html for your application. This token is stored as a random string in the session, to which an attacker does not have access. When a request reaches your application, Rails verifies the received token with the token in the session. Only HTML and JavaScript requests are checked, so this will not protect your XML API (presumably you'll have a different authentication scheme there anyway). Also, GET requests are not protected as these should be idempotent.

It's important to remember that XML or JSON requests are also affected and if you're building an API you'll need something like:

class ApplicationController < ActionController::Base
  protect_from_forgery
  skip_before_action :verify_authenticity_token, if: :json_request?

  protected

  def json_request?
    request.format.json?
  end
end

CSRF protection is turned on with the protect_from_forgery method, which checks the token and resets the session if it doesn't match what was expected. A call to this method is generated for new Rails applications by default.

The token parameter is named authenticity_token by default. The name and value of this token must be added to every layout that renders forms by including csrf_meta_tags in the html head.

Learn more about CSRF attacks and securing your application in the Ruby on Rails Security Guide.

Namespace
Methods
F
H
P
V
Included Modules
Instance Protected methods
form_authenticity_param()

The form's authenticity parameter. Override to provide your own.

Source: show | on GitHub 

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 201
def form_authenticity_param
  params[request_forgery_protection_token]
end
form_authenticity_token()

Sets the token value for the current session.

Source: show | on GitHub 

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 196
def form_authenticity_token
  session[:_csrf_token] ||= SecureRandom.base64(32)
end
handle_unverified_request()

Source: show | on GitHub 

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 172
def handle_unverified_request
  forgery_protection_strategy.new(self).handle_unverified_request
end
protect_against_forgery?()

Source: show | on GitHub 

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 205
def protect_against_forgery?
  allow_forgery_protection
end
verified_request?()

Returns true or false if a request is verified. Checks:

Source: show | on GitHub 

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 189
def verified_request?
  !protect_against_forgery? || request.get? || request.head? ||
    form_authenticity_token == params[request_forgery_protection_token] ||
    form_authenticity_token == request.headers['X-CSRF-Token']
end
verify_authenticity_token()

The actual before_action that is used. Modify this to change how you handle unverified requests.

Source: show | on GitHub 

# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 177
def verify_authenticity_token
  unless verified_request?
    logger.warn "Can't verify CSRF token authenticity" if logger
    handle_unverified_request
  end
end