--- !ruby/object:RI::MethodDescription 
aliases: []

block_params: 
comment: 
- !ruby/struct:SM::Flow::P 
  body: Protect a controller's actions from CSRF attacks by ensuring that all forms are coming from the current web application, not a forged link from another site. This is done by embedding a token based on the session (which an attacker wouldn't know) in all forms and Ajax requests generated by Rails and then verifying the authenticity of that token in the controller. Only HTML/JavaScript requests are checked, so this will not protect your XML API (presumably you'll have a different authentication scheme there anyway). Also, GET requests are not protected as these should be indempotent anyway.
- !ruby/struct:SM::Flow::P 
  body: "You turn this on with the #protect_from_forgery method, which will perform the check and raise an ActionController::InvalidAuthenticityToken if the token doesn't match what was expected. And it will add a _authenticity_token parameter to all forms that are automatically generated by Rails. You can customize the error message given through public/422.html."
- !ruby/struct:SM::Flow::P 
  body: "Learn more about CSRF (Cross-Site Request Forgery) attacks:"
- !ruby/object:SM::Flow::LIST 
  contents: 
  - !ruby/struct:SM::Flow::LI 
    label: "*"
    body: http://isc.sans.org/diary.html?storyid=1750
  - !ruby/struct:SM::Flow::LI 
    label: "*"
    body: http://en.wikipedia.org/wiki/Cross-site_request_forgery
  type: :BULLET
- !ruby/struct:SM::Flow::P 
  body: "Keep in mind, this is NOT a silver-bullet, plug 'n' play, warm security blanket for your rails application. There are a few guidelines you should follow:"
- !ruby/object:SM::Flow::LIST 
  contents: 
  - !ruby/struct:SM::Flow::LI 
    label: "*"
    body: "Keep your GET requests safe and idempotent. More reading material:"
  - !ruby/object:SM::Flow::LIST 
    contents: 
    - !ruby/struct:SM::Flow::LI 
      label: "*"
      body: http://www.xml.com/pub/a/2002/04/24/deviant.html
    - !ruby/struct:SM::Flow::LI 
      label: "*"
      body: http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.1.1
    type: :BULLET
  - !ruby/struct:SM::Flow::LI 
    label: "*"
    body: "Make sure the session cookies that Rails creates are non-persistent. Check in Firefox and look for &quot;Expires: at end of session&quot;"
  type: :BULLET
- !ruby/struct:SM::Flow::P 
  body: If you need to construct a request yourself, but still want to take advantage of forgery protection, you can grab the authenticity_token using the form_authenticity_token helper method and make it part of the parameters yourself.
- !ruby/struct:SM::Flow::P 
  body: "Example:"
- !ruby/struct:SM::Flow::VERB 
  body: "  class FooController &lt; ApplicationController\n    # uses the cookie session store (then you don't need a separate :secret)\n    protect_from_forgery :except =&gt; :index\n\n    # uses one of the other session stores that uses a session_id value.\n    protect_from_forgery :secret =&gt; 'my-little-pony', :except =&gt; :index\n\n    # you can disable csrf protection on controller-by-controller basis:\n    skip_before_filter :verify_authenticity_token\n  end\n"
- !ruby/struct:SM::Flow::P 
  body: "If you are upgrading from Rails 1.x, disable forgery protection to simplify your tests. Add this to config/environments/test.rb:"
- !ruby/struct:SM::Flow::VERB 
  body: "  # Disable request forgery protection in test environment\n  config.action_controller.allow_forgery_protection = false\n"
- !ruby/struct:SM::Flow::P 
  body: "Valid Options:"
- !ruby/object:SM::Flow::LIST 
  contents: 
  - !ruby/struct:SM::Flow::LI 
    label: "*"
    body: <tt>:only/:except</tt> - passed to the before_filter call. Set which actions are verified.
  - !ruby/struct:SM::Flow::LI 
    label: "*"
    body: <tt>:secret</tt> - Custom salt used to generate the form_authenticity_token. Leave this off if you are using the cookie session store.
  - !ruby/struct:SM::Flow::LI 
    label: "*"
    body: <tt>:digest</tt> - Message digest used for hashing. Defaults to 'SHA1'
  type: :BULLET
full_name: ActionController::RequestForgeryProtection::ClassMethods#protect_from_forgery
is_singleton: false
name: protect_from_forgery
params: (options = {})
visibility: public
