diff options
Diffstat (limited to 'actionpack/lib/action_controller/request_forgery_protection.rb')
-rw-r--r-- | actionpack/lib/action_controller/request_forgery_protection.rb | 19 |
1 files changed, 12 insertions, 7 deletions
diff --git a/actionpack/lib/action_controller/request_forgery_protection.rb b/actionpack/lib/action_controller/request_forgery_protection.rb index 1802acc568..803782113d 100644 --- a/actionpack/lib/action_controller/request_forgery_protection.rb +++ b/actionpack/lib/action_controller/request_forgery_protection.rb @@ -1,5 +1,6 @@ module ActionController #:nodoc: - class InvalidToken < ActionControllerError; end + class InvalidAuthenticityToken < ActionControllerError #:nodoc: + end module RequestForgeryProtection def self.included(base) @@ -18,23 +19,27 @@ module ActionController #:nodoc: # HTML/JavaScript requests are checked, so this will not protect your XML API (presumably you'll have a different authentication # scheme there anyway). Also, GET requests are not protected as these should be indempotent anyway. # - # You turn this on with the #protect_from_forgery method, which will perform the check and raise an ActionController::InvalidToken if - # the token doesn't match what was expected. And it will add a _token parameter to all forms that are automatically generated - # by Rails. You can customize the error message given through public/422.html. + # You turn this on with the #protect_from_forgery method, which will perform the check and raise + # an ActionController::InvalidAuthenticityToken if the token doesn't match what was expected. And it will add + # a _authenticity_token parameter to all forms that are automatically generated by Rails. You can customize the error message + # given through public/422.html. # # Learn more about CSRF (Cross-Site Request Forgery) attacks: # # * http://isc.sans.org/diary.html?storyid=1750 # * http://en.wikipedia.org/wiki/Cross-site_request_forgery # - # Keep in mind, this is NOT a silver-bullet, plug 'n' play, warm security blanket for your rails application. There are a few guidelines you - # should follow: + # Keep in mind, this is NOT a silver-bullet, plug 'n' play, warm security blanket for your rails application. + # There are a few guidelines you should follow: # # * Keep your GET requests safe and idempotent. More reading material: # * http://www.xml.com/pub/a/2002/04/24/deviant.html # * http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.1.1 # * Make sure the session cookies that Rails creates are non-persistent. Check in Firefox and look for "Expires: at end of session" # + # If you need to construct a request yourself, but still want to take advantage of forgery protection, you can grab the + # authenticity_token using the form_authenticity_token helper method and make it part of the parameters yourself. + # # Example: # # class FooController < ApplicationController @@ -61,7 +66,7 @@ module ActionController #:nodoc: protected # The actual before_filter that is used. Modify this to change how you handle unverified requests. def verify_authenticity_token - verified_request? || raise(ActionController::InvalidToken) + verified_request? || raise(ActionController::InvalidAuthenticityToken) end # Returns true or false if a request is verified. Checks: |