diff options
| author | Vijay Dev <vijaydev.cse@gmail.com> | 2011-02-20 01:18:03 +0530 |
|---|---|---|
| committer | Vijay Dev <vijaydev.cse@gmail.com> | 2011-02-20 01:18:03 +0530 |
| commit | 7e8b075f73007e02af19bf8b17855355f6793018 (patch) | |
| tree | 408ee8bc4083d329c8410eaf246688f39fd9f6ee /railties/guides/source/security.textile | |
| parent | cff0aebbc4e4a3c586066eb289e667de0962aedb (diff) | |
| download | rails-7e8b075f73007e02af19bf8b17855355f6793018.tar.gz rails-7e8b075f73007e02af19bf8b17855355f6793018.tar.bz2 rails-7e8b075f73007e02af19bf8b17855355f6793018.zip | |
session is reset on token mismatch
Diffstat (limited to 'railties/guides/source/security.textile')
| -rw-r--r-- | railties/guides/source/security.textile | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/railties/guides/source/security.textile b/railties/guides/source/security.textile index 7f303c3565..5613156245 100644 --- a/railties/guides/source/security.textile +++ b/railties/guides/source/security.textile @@ -240,7 +240,7 @@ There are many other possibilities, including Ajax to attack the victim in the b protect_from_forgery :secret => "123456789012345678901234567890..." </ruby> -This will automatically include a security token, calculated from the current session and the server-side secret, in all forms and Ajax requests generated by Rails. You won't need the secret, if you use CookieStorage as session storage. It will raise an ActionController::InvalidAuthenticityToken error, if the security token doesn't match what was expected. +This will automatically include a security token, calculated from the current session and the server-side secret, in all forms and Ajax requests generated by Rails. You won't need the secret, if you use CookieStorage as session storage. If the security token doesn't match what was expected, the session will be reset. *Note:* In Rails versions prior to 3.0.4, this raised an <tt>ActionController::InvalidAuthenticityToken</tt> error. Note that _(highlight)cross-site scripting (XSS) vulnerabilities bypass all CSRF protections_. XSS gives the attacker access to all elements on a page, so he can read the CSRF security token from a form or directly submit the form. Read <a href="#cross-site-scripting-xss">more about XSS</a> later. |