diff options
author | Willian Gustavo Veiga <beberveiga@gmail.com> | 2018-10-02 12:55:36 -0300 |
---|---|---|
committer | Willian Gustavo Veiga <beberveiga@gmail.com> | 2018-10-02 12:57:37 -0300 |
commit | 2d4df1349efdf8dd2c8cc4503fd5a871b0066500 (patch) | |
tree | 9f71a297cf1bb30f1d59039997a60f97357d0782 /actionpack/lib/action_controller/metal/request_forgery_protection.rb | |
parent | 00c50c2b5966fa1d719c8a58564811c672a0e8c6 (diff) | |
parent | cf608ee34dd833b0357ef4eefa692db33242d2aa (diff) | |
download | rails-2d4df1349efdf8dd2c8cc4503fd5a871b0066500.tar.gz rails-2d4df1349efdf8dd2c8cc4503fd5a871b0066500.tar.bz2 rails-2d4df1349efdf8dd2c8cc4503fd5a871b0066500.zip |
Merge branch 'master' into feature/reselect-method
Diffstat (limited to 'actionpack/lib/action_controller/metal/request_forgery_protection.rb')
-rw-r--r-- | actionpack/lib/action_controller/metal/request_forgery_protection.rb | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/actionpack/lib/action_controller/metal/request_forgery_protection.rb b/actionpack/lib/action_controller/metal/request_forgery_protection.rb index edfef39771..cb109c6ad8 100644 --- a/actionpack/lib/action_controller/metal/request_forgery_protection.rb +++ b/actionpack/lib/action_controller/metal/request_forgery_protection.rb @@ -17,7 +17,7 @@ module ActionController #:nodoc: # access. When a request reaches your application, \Rails verifies the received # token with the token in the session. All requests are checked except GET requests # as these should be idempotent. Keep in mind that all session-oriented requests - # should be CSRF protected, including JavaScript and HTML requests. + # are CSRF protected by default, including JavaScript and HTML requests. # # Since HTML and JavaScript requests are typically made from the browser, we # need to ensure to verify request authenticity for the web browser. We can @@ -30,16 +30,23 @@ module ActionController #:nodoc: # URL on your site. When your JavaScript response loads on their site, it executes. # With carefully crafted JavaScript on their end, sensitive data in your JavaScript # response may be extracted. To prevent this, only XmlHttpRequest (known as XHR or - # Ajax) requests are allowed to make GET requests for JavaScript responses. + # Ajax) requests are allowed to make requests for JavaScript responses. # - # It's important to remember that XML or JSON requests are also affected and if - # you're building an API you should change forgery protection method in + # It's important to remember that XML or JSON requests are also checked by default. If + # you're building an API or an SPA you could change forgery protection method in # <tt>ApplicationController</tt> (by default: <tt>:exception</tt>): # # class ApplicationController < ActionController::Base # protect_from_forgery unless: -> { request.format.json? } # end # + # It is generally safe to exclude XHR requests from CSRF protection + # (like the code snippet above does), because XHR requests can only be made from + # the same origin. Note however that any cross-origin third party domain + # allowed via {CORS}[https://en.wikipedia.org/wiki/Cross-origin_resource_sharing] + # will also be able to create XHR requests. Be sure to check your + # CORS configuration before disabling forgery protection for XHR. + # # CSRF protection is turned on with the <tt>protect_from_forgery</tt> method. # By default <tt>protect_from_forgery</tt> protects your session with # <tt>:null_session</tt> method, which provides an empty session |