aboutsummaryrefslogtreecommitdiffstats
path: root/guides/source/upgrading_ruby_on_rails.md
diff options
context:
space:
mode:
authorJeremy Kemper <jeremy@bitsweat.net>2013-12-17 15:40:11 -0700
committerJeremy Kemper <jeremy@bitsweat.net>2013-12-17 15:40:11 -0700
commitd3fcaba6266d99ef9a5ad6d9154b1257e1300310 (patch)
treee2186fe0a3babf4c7f700d36a0a22a8ab1b2bcfa /guides/source/upgrading_ruby_on_rails.md
parent626ced225cd88d29557d2e6e2dbaed1db5c7ea7f (diff)
downloadrails-d3fcaba6266d99ef9a5ad6d9154b1257e1300310.tar.gz
rails-d3fcaba6266d99ef9a5ad6d9154b1257e1300310.tar.bz2
rails-d3fcaba6266d99ef9a5ad6d9154b1257e1300310.zip
Mention new CSRF protection gotcha in upgrade guide
Diffstat (limited to 'guides/source/upgrading_ruby_on_rails.md')
-rw-r--r--guides/source/upgrading_ruby_on_rails.md27
1 files changed, 26 insertions, 1 deletions
diff --git a/guides/source/upgrading_ruby_on_rails.md b/guides/source/upgrading_ruby_on_rails.md
index 33e58f892e..2f0f3573fb 100644
--- a/guides/source/upgrading_ruby_on_rails.md
+++ b/guides/source/upgrading_ruby_on_rails.md
@@ -27,6 +27,31 @@ Upgrading from Rails 4.0 to Rails 4.1
NOTE: This section is a work in progress.
+### CSRF protection from remote `<script>` tags
+
+Or, "whaaat my tests are failing!!!?"
+
+Cross-site request forgery (CSRF) protection now covers GET requests with
+JavaScript responses, too. That prevents a third-party site from referencing
+your JavaScript URL and attempting to run it to extract sensitive data.
+
+This means that your functional and integration tests that use
+
+```ruby
+get :index, format: :js
+```
+
+will now trigger CSRF protection. Switch to
+
+```ruby
+xhr :get, :index, format: :js
+```
+
+to explicitly test an XmlHttpRequest.
+
+If you really mean to load JavaScript from remote `<script>` tags, skip CSRF
+protection on that action.
+
### Spring
If you want to use Spring as your application preloader you need to:
@@ -68,7 +93,7 @@ secrets, you need to:
### Changes in JSON handling
-The are a few major changes related to JSON handling in Rails 4.1.
+There are a few major changes related to JSON handling in Rails 4.1.
#### MultiJSON removal