Sha256: fa241b8d65441ceafe3753d10194c90b463a7ec73119bd454aea440de8c4b681
Contents?: true
Size: 835 Bytes
Versions: 11
Compression:
Stored size: 835 Bytes
Contents
# frozen_string_literal: true
module Quilt
class HeaderCsrfStrategy
HEADER = "x-shopify-react-xhr"
HEADER_VALUE = "1"
def initialize(controller)
@controller = controller
end
def handle_unverified_request
raise NoSameSiteHeaderError unless same_site?
end
private
def same_site?
@controller.request.headers[HEADER] == HEADER_VALUE
end
def fallback_handler
ActionController::RequestForgeryProtection::ProtectionMethods::Exception.new(@controller)
end
class NoSameSiteHeaderError < StandardError
def initialize
# rubocop:disable LineLength
super "CSRF verification failed. This request is missing the `x-shopify-react-xhr` header, or it does not have the expected value."
# rubocop:enable LineLength
end
end
end
end
Version data entries
11 entries across 11 versions & 1 rubygems