aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/test/controller/request_forgery_protection_test.rb
Commit message (Expand)AuthorAgeFilesLines
* applies new string literal convention in actionpack/testXavier Noria2016-08-061-70/+70
* Make sure the tests setup are made correctlyRafael Mendonça França2016-07-171-9/+9
* Respect `log_warning_on_csrf_failure` setting for all CSRF failuresMatthew Caruana Galizia2016-05-231-0/+31
* Discart the schema and host information when building the per-form tokenRafael Mendonça França2016-04-201-0/+13
* Make per form token work when method is not providedRafael Mendonça França2016-02-221-2/+16
* Refactored Request Forgery CSRF PerFormTokensController tests and DRY'ed them...Vipul A M2016-02-221-70/+38
* Fixed passing of delete method on button_to tag, creating wrong form csrf tokenVipul A M2016-02-211-0/+44
* add option for per-form CSRF tokensBen Toews2016-01-041-0/+172
* Change the `protect_from_forgery` prepend default to `false`eileencodes2015-12-071-2/+2
* Add option to verify Origin header in CSRF checksBen Toews2015-11-251-0/+45
* Remove mocha from ActionPack testsMarcin Olichwirowicz2015-09-051-1/+0
* Get rid of mocha tests - part 2Marcin Olichwirowicz2015-08-251-8/+24
* Get rid of mocha tests - part 1Marcin Olichwirowicz2015-08-241-33/+46
* Stop using deprecated `render :text` in testPrem Sichanugrist2015-07-171-1/+1
* let the superclass build the request and responseAaron Patterson2015-07-081-2/+1
* Deprecate `:nothing` option for render methodMehmet Emin İNAÇ2015-05-281-3/+3
* Removed unused code from request_forgery_protection testsPrathamesh Sonpatki2015-04-261-17/+0
* Handle non-string authenticity tokensVille Lautanala2015-02-121-0/+7
* Migrating xhr methods to keyword arguments syntaxKir Shatrov2015-02-011-7/+7
* Switch to kwargs in ActionController::TestCase and ActionDispatch::IntegrationKir Shatrov2015-01-291-10/+10
* Add prepend option to protect_from_forgery.Josef Šimánek2015-01-081-0/+60
* Merge pull request #16570 from bradleybuda/breach-mitigation-mask-csrf-tokenJeremy Kemper2014-08-191-5/+6
|\
| * Auth token mask from breach-mitigation-rails gemBradley Buda2014-08-191-5/+6
* | Remove unneeded comment in test.Timm2014-06-161-1/+1
* | Nokogiri leaves '<' unescaped, so the assert_select looking for '&lt;' will n...Timm2014-06-161-2/+3
* | Fixed Nokogiri::CSS::SyntaxErrors.Timm2014-06-151-2/+2
|/
* Avoid hardcoded value in teardown.Zuhao Wan2014-05-281-3/+6
* Moved 'params[request_forgery_protection_token]' into its own method and impr...Tom Kadwill2014-05-061-5/+26
* Remove wrapper div for inputs in button_toRafael Mendonça França2014-04-171-1/+1
* Update Request forgery tests to remove input wrappign divRafael Mendonça França2014-04-171-5/+5
* Make CSRF failure logging optional/configurable.John Barton (joho)2014-03-051-0/+16
* Clearly limit new CSRF protection to GET requestsJeremy Kemper2013-12-171-0/+10
* CSRF protection from cross-origin <script> tagsJeremy Kemper2013-12-171-9/+69
* NullSessionHash#destroy should be a no-opJonathan Baudanza2013-09-181-0/+10
* Fix #9168 Initialize NullCookieJar with all options needed for KeyGeneratorAndrey Chernih2013-02-081-0/+35
* Added a test that shows that a HEAD request does not normally pass CSRF prote...Michiel Sikkes2013-01-221-0/+4
* deprecate `assert_blank` and `assert_present`.Yves Senn2013-01-051-1/+1
* Implement :null_session CSRF protection methodSergey Nartimov2012-09-131-10/+6
* no need to pass an empty block to button_to helperSergey Nartimov2012-05-301-2/+2
* Cover one more case in auth_token and remote formsPiotr Sarnacki2012-03-281-0/+7
* config.action_view.embed_authenticity_token_in_remote_forms is true by defaultPiotr Sarnacki2012-03-281-19/+14
* Added config.action_view.embed_authenticity_token_in_remote_formsPiotr Sarnacki2012-03-281-2/+48
* fixed - warning: ambiguous first argument; put parentheses or even spacesSandeep2012-03-161-1/+1
* Allow you to force the authenticity_token to be rendered even on remote forms...David Heinemeier Hansson2012-03-141-0/+11
* Do not include the authenticity token in forms where remote: true as ajax for...David Heinemeier Hansson2012-03-141-0/+13
* configure how unverified request will be handledSergey Nartimov2012-03-091-2/+2
* Add config.default_method_for_update to support PATCHDavid Lee2012-02-221-1/+14
* Remove not used requires from csrf helper file and testCarlos Antonio da Silva2012-01-211-7/+0
* Remove rescue_action from compatibility module and testsCarlos Antonio da Silva2012-01-171-2/+0
* Use ensure instead of rescueMike Dillon2011-09-101-1/+1
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-30 10:45:46 +0000