diff options
| author | Vijay Dev <vijaydev.cse@gmail.com> | 2011-05-02 17:39:46 +0530 |
|---|---|---|
| committer | Vijay Dev <vijaydev.cse@gmail.com> | 2011-05-02 17:39:46 +0530 |
| commit | 09edaf49646c14b6162726c1fb2bc0e980c3962f (patch) | |
| tree | 83c4ce1b4215f20b70bf6a38e9eb14db5221cb92 | |
| parent | 527036ebd106fdb4d5890f00f2576a99c57b1514 (diff) | |
| download | rails-09edaf49646c14b6162726c1fb2bc0e980c3962f.tar.gz rails-09edaf49646c14b6162726c1fb2bc0e980c3962f.tar.bz2 rails-09edaf49646c14b6162726c1fb2bc0e980c3962f.zip | |
removed reference to verify method
| -rw-r--r-- | railties/guides/source/security.textile | 10 |
1 files changed, 1 insertions, 9 deletions
diff --git a/railties/guides/source/security.textile b/railties/guides/source/security.textile index 40fe764ae9..8c408ec06b 100644 --- a/railties/guides/source/security.textile +++ b/railties/guides/source/security.textile @@ -211,15 +211,7 @@ The HTTP protocol basically provides two main types of requests - GET and POST ( If your web application is RESTful, you might be used to additional HTTP verbs, such as PUT or DELETE. Most of today‘s web browsers, however do not support them - only GET and POST. Rails uses a hidden +_method+ field to handle this barrier. -_(highlight)The verify method in a controller can make sure that specific actions may not be used over GET_. Here is an example to verify the use of the transfer action over POST. If the action comes in using any other verb, it redirects to the list action. - -<ruby> -verify :method => :post, :only => [:transfer], :redirect_to => {:action => :list} -</ruby> - -With this precaution, the attack from above will not work, because the browser sends a GET request for images, which will not be accepted by the web application. - -But this was only the first step, because _(highlight)POST requests can be sent automatically, too_. Here is an example for a link which displays www.harmless.com as destination in the browser's status bar. In fact it dynamically creates a new form that sends a POST request. +_(highlight)POST requests can be sent automatically, too_. Here is an example for a link which displays www.harmless.com as destination in the browser's status bar. In fact it dynamically creates a new form that sends a POST request. <html> <a href="http://www.harmless.com/" onclick=" |