Change from InvalidToken to InvalidAuthenticityToken to be more specific

git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@7623 5ecf4fe2-1ee6-0310-87b1-e25e094e27de

1 files changed, 12 insertions, 7 deletions

diff --git a/actionpack/lib/action_controller/request_forgery_protection.rb b/actionpack/lib/action_controller/request_forgery_protection.rb
index 1802acc568..803782113d 100644
--- a/actionpack/lib/action_controller/request_forgery_protection.rb
+++ b/actionpack/lib/action_controller/request_forgery_protection.rb
@@ -1,5 +1,6 @@
 module ActionController #:nodoc:
-  class InvalidToken < ActionControllerError; end
+  class InvalidAuthenticityToken < ActionControllerError #:nodoc:
+  end
 
   module RequestForgeryProtection
     def self.included(base)
@@ -18,23 +19,27 @@ module ActionController #:nodoc:
       # HTML/JavaScript requests are checked, so this will not protect your XML API (presumably you'll have a different authentication
       # scheme there anyway). Also, GET requests are not protected as these should be indempotent anyway.
       #
-      # You turn this on with the #protect_from_forgery method, which will perform the check and raise an ActionController::InvalidToken if
-      # the token doesn't match what was expected. And it will add a _token parameter to all forms that are automatically generated
-      # by Rails. You can customize the error message given through public/422.html.
+      # You turn this on with the #protect_from_forgery method, which will perform the check and raise 
+      # an ActionController::InvalidAuthenticityToken if the token doesn't match what was expected. And it will add 
+      # a _authenticity_token parameter to all forms that are automatically generated by Rails. You can customize the error message 
+      # given through public/422.html.
       #
       # Learn more about CSRF (Cross-Site Request Forgery) attacks:
       #
       # * http://isc.sans.org/diary.html?storyid=1750
       # * http://en.wikipedia.org/wiki/Cross-site_request_forgery
       #
-      # Keep in mind, this is NOT a silver-bullet, plug 'n' play, warm security blanket for your rails application.  There are a few guidelines you
-      # should follow:
+      # Keep in mind, this is NOT a silver-bullet, plug 'n' play, warm security blanket for your rails application.
+      # There are a few guidelines you should follow:
       # 
       # * Keep your GET requests safe and idempotent.  More reading material:
       #   * http://www.xml.com/pub/a/2002/04/24/deviant.html
       #   * http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.1.1
       # * Make sure the session cookies that Rails creates are non-persistent.  Check in Firefox and look for "Expires: at end of session"
       #
+      # If you need to construct a request yourself, but still want to take advantage of forgery protection, you can grab the 
+      # authenticity_token using the form_authenticity_token helper method and make it part of the parameters yourself.
+      #
       # Example:
       #
       #   class FooController < ApplicationController
@@ -61,7 +66,7 @@ module ActionController #:nodoc:
     protected
       # The actual before_filter that is used.  Modify this to change how you handle unverified requests.
       def verify_authenticity_token
-        verified_request? || raise(ActionController::InvalidToken)
+        verified_request? || raise(ActionController::InvalidAuthenticityToken)
       end
       
       # Returns true or false if a request is verified.  Checks: