Controller actions are protected from Cross-Site Request Forgery (CSRF) attacks by including a token in the rendered html for your application. This token is stored as a random string in the session, to which an attacker does not have access. When a request reaches your application, Rails verifies the received token with the token in the session. Only HTML and JavaScript requests are checked, so this will not protect your XML API (presumably you'll have a different authentication scheme there anyway).
GET requests are not protected since they don't have side effects like writing to the database and don't leak sensitive information. JavaScript requests are an exception: a third-party site can use a <script> tag to reference a JavaScript URL on your site. When your JavaScript response loads on their site, it executes. With carefully crafted JavaScript on their end, sensitive data in your JavaScript response may be extracted. To prevent this, only XmlHttpRequest (known as XHR or Ajax) requests are allowed to make GET requests for JavaScript responses.
It's important to remember that XML or JSON requests are also affected and if you're building an API you'll need something like:
class ApplicationController < ActionController::Base
protect_from_forgery
skip_before_action :verify_authenticity_token, if: :json_request?
protected
def json_request?
request.format.json?
end
end
CSRF protection is turned on with the protect_from_forgery
method, which checks the token and resets the session if it doesn't
match what was expected. A call to this method is generated for new Rails
applications by default.
The token parameter is named authenticity_token
by default.
The name and value of this token must be added to every layout that renders
forms by including csrf_meta_tags
in the html
head
.
Learn more about CSRF attacks and securing your application in the Ruby on Rails Security Guide.
- MODULE ActionController::RequestForgeryProtection::ClassMethods
- MODULE ActionController::RequestForgeryProtection::ProtectionMethods
- F
- H
- M
- N
- P
- V
CROSS_ORIGIN_JAVASCRIPT_WARNING | = | "Security warning: an embedded " \ "<script> tag on another site requested protected JavaScript. " \ "If you know what you're doing, go ahead and disable forgery " \ "protection on this action to permit cross-origin JavaScript embedding." |
The form's authenticity parameter. Override to provide your own.
Sets the token value for the current session.
GET requests are checked for cross-origin JavaScript after rendering.
If the `verify_authenticity_token` before_action ran, verify that JavaScript responses are only served to same-origin GET requests.
Check for cross-origin JavaScript responses.
Checks if the controller allows forgery protection.
Returns true or false if a request is verified. Checks:
-
is it a GET or HEAD request? Gets should be safe and idempotent
-
Does the #form_authenticity_token match the given token value from the params?
-
Does the X-CSRF-Token header match the #form_authenticity_token
# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 242 def verified_request? !protect_against_forgery? || request.get? || request.head? || form_authenticity_token == params[request_forgery_protection_token] || form_authenticity_token == request.headers['X-CSRF-Token'] end
The actual before_action that is used to verify the CSRF token. Don't override this directly. Provide your own forgery protection strategy instead. If you override, you'll disable same-origin `<script>` verification.
Lean on the protect_from_forgery declaration to mark which actions are due for same-origin request verification. If protect_from_forgery is enabled on an action, this before_action flags its after_action to verify that JavaScript responses are for XHR requests, ensuring they follow the browser's same-origin policy.
If `verify_authenticity_token` was run (indicating that we have forgery protection enabled for this request) then also verify that we aren't serving an unauthorized cross-origin response.
# File actionpack/lib/action_controller/metal/request_forgery_protection.rb, line 214 def verify_same_origin_request if marked_for_same_origin_verification? && non_xhr_javascript_response? logger.warn CROSS_ORIGIN_JAVASCRIPT_WARNING if logger raise ActionController::InvalidCrossOriginRequest, CROSS_ORIGIN_JAVASCRIPT_WARNING end end