# module ActionController::RequestForgeryProtection

Controller actions are protected from Cross-Site Request Forgery (CSRF) attacks by including a token in the rendered html for your application. This token is stored as a random string in the session, to which an attacker does not have access. When a request reaches your application, Rails verifies the received token with the token in the session. Only HTML and JavaScript requests are checked, so this will not protect your XML API (presumably you’ll have a different authentication scheme there anyway). Also, GET requests are not protected as these should be idempotent.

CSRF protection is turned on with the `protect_from_forgery` method, which checks the token and resets the session if it doesn’t match what was expected. A call to this method is generated for new Rails applications by default. You can customize the error message by editing public/422.html.

The token parameter is named `authenticity_token` by default. The name and value of this token must be added to every layout that renders forms by including `csrf_meta_tags` in the html `head`.

Learn more about CSRF attacks and securing your application in the Ruby on Rails Security Guide.

### Protected Instance Methods

form_authenticity_param() click to toggle source

The form’s authenticity parameter. Override to provide your own.

    # File lib/action_controller/metal/request_forgery_protection.rb, line 105
    def form_authenticity_param
      params[request_forgery_protection_token]
    end

form_authenticity_token() click to toggle source

Sets the token value for the current session.

    # File lib/action_controller/metal/request_forgery_protection.rb, line 100
    def form_authenticity_token
      session[:_csrf_token] ||= SecureRandom.base64(32)
    end

handle_unverified_request() click to toggle source

This is the method that defines the application behavior when a request is found to be unverified. By default, Rails resets the session when it finds an unverified request.

    # File lib/action_controller/metal/request_forgery_protection.rb, line 84
    def handle_unverified_request
      reset_session
    end

protect_against_forgery?() click to toggle source

    # File lib/action_controller/metal/request_forgery_protection.rb, line 109
    def protect_against_forgery?
      allow_forgery_protection
    end

verified_request?() click to toggle source

Returns true or false if a request is verified. Checks:

- is it a GET request? Gets should be safe and idempotent

- Does the #form_authenticity_token match the given token value from the params?

- Does the X-CSRF-Token header match the #form_authenticity_token

    # File lib/action_controller/metal/request_forgery_protection.rb, line 93
    def verified_request?
      !protect_against_forgery? || request.get? ||
        form_authenticity_token == params[request_forgery_protection_token] ||
        form_authenticity_token == request.headers['X-CSRF-Token']
    end

verify_authenticity_token() click to toggle source

The actual before_filter that is used. Modify this to change how you handle unverified requests.

    # File lib/action_controller/metal/request_forgery_protection.rb, line 75
    def verify_authenticity_token
      unless verified_request?
        logger.warn "WARNING: Can't verify CSRF token authenticity" if logger
        handle_unverified_request
      end
    end