Sha256: 1910f72253d4614676e67b26094ba196b8a0962f754bff1f3d27c212bf7bf6b1
Contents?: true
Size: 717 Bytes
Versions: 69
Compression:
Stored size: 717 Bytes
Contents
require 'rack/protection'
module Rack
module Protection
##
# Prevented attack:: CSRF
# Supported browsers:: all
# More infos:: http://en.wikipedia.org/wiki/Cross-site_request_forgery
#
# Only accepts unsafe HTTP requests if a given access token matches the token
# included in the session.
#
# Compatible with Rails and rack-csrf.
class AuthenticityToken < Base
def accepts?(env)
return true if safe? env
session = session env
token = session[:csrf] ||= session['_csrf_token'] || random_string
env['HTTP_X_CSRF_TOKEN'] == token or
Request.new(env).params['authenticity_token'] == token
end
end
end
end
Version data entries
69 entries across 67 versions & 5 rubygems