diff options
| author | David Heinemeier Hansson <david@loudthinking.com> | 2015-01-05 17:36:01 -0800 |
|---|---|---|
| committer | David Heinemeier Hansson <david@loudthinking.com> | 2015-01-05 17:36:01 -0800 |
| commit | de4f40826e3b979735e4f3287725f1a7a3820818 (patch) | |
| tree | 3249ecf9af7bd7544686eaa8f949a922f08dabd3 | |
| parent | 896a6b1aed6907df5cd9f60f407848406fa0d05c (diff) | |
| parent | 734306612e2ec5fe1c978d37e401f81beb79e93b (diff) | |
| download | rails-de4f40826e3b979735e4f3287725f1a7a3820818.tar.gz rails-de4f40826e3b979735e4f3287725f1a7a3820818.tar.bz2 rails-de4f40826e3b979735e4f3287725f1a7a3820818.zip | |
Merge pull request #18354 from simi/improve-request-forgery-documentation
Improve protect_from_forgery documentation.
| -rw-r--r-- | actionpack/lib/action_controller/metal/request_forgery_protection.rb | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/actionpack/lib/action_controller/metal/request_forgery_protection.rb b/actionpack/lib/action_controller/metal/request_forgery_protection.rb index 0932f03916..b9a1e7d242 100644 --- a/actionpack/lib/action_controller/metal/request_forgery_protection.rb +++ b/actionpack/lib/action_controller/metal/request_forgery_protection.rb @@ -80,13 +80,13 @@ module ActionController #:nodoc: # class FooController < ApplicationController # protect_from_forgery except: :index # - # You can disable CSRF protection on controller by skipping the verification before_action: + # You can disable forgery protection on controller by skipping the verification before_action: # skip_before_action :verify_authenticity_token # # Valid Options: # - # * <tt>:only/:except</tt> - Passed to the <tt>before_action</tt> call. Set which actions are verified. - # * <tt>:if/:unless</tt> - Passed to the <tt>before_action</tt> call. Set when actions are verified. + # * <tt>:only/:except</tt> - Only apply forgery protection to a subset of actions. Like <tt>only: [ :create, :create_all ]</tt>. + # * <tt>:if/:unless</tt> - Turn off the forgery protection entirely depending on the passed proc or method reference. # * <tt>:with</tt> - Set the method to handle unverified request. # # Valid unverified request handling methods are: |