--- !ruby/object:RI::ClassDescription 
attributes: []

class_methods: []

comment: 
- !ruby/struct:SM::Flow::P 
  body: Protecting controller actions from CSRF attacks by ensuring that all forms are coming from the current web application, not a forged link from another site, is done by embedding a token based on the session (which an attacker wouldn't know) in all forms and Ajax requests generated by Rails and then verifying the authenticity of that token in the controller. Only HTML/JavaScript requests are checked, so this will not protect your XML API (presumably you'll have a different authentication scheme there anyway). Also, GET requests are not protected as these should be indempotent anyway.
- !ruby/struct:SM::Flow::P 
  body: This is turned on with the <tt>protect_from_forgery</tt> method, which will check the token and raise an ActionController::InvalidAuthenticityToken if it doesn't match what was expected. You can customize the error message in production by editing public/422.html. A call to this method in ApplicationController is generated by default in post-Rails 2.0 applications.
- !ruby/struct:SM::Flow::P 
  body: "The token parameter is named <tt>authenticity_token</tt> by default. If you are generating an HTML form manually (without the use of Rails' <tt>form_for</tt>, <tt>form_tag</tt> or other helpers), you have to include a hidden field named like that and set its value to what is returned by <tt>form_authenticity_token</tt>. Same applies to manually constructed Ajax requests. To make the token available through a global variable to scripts on a certain page, you could add something like this to a view:"
- !ruby/struct:SM::Flow::VERB 
  body: "  &lt;%= javascript_tag &quot;window._token = '#{form_authenticity_token}'&quot; %&gt;\n"
- !ruby/struct:SM::Flow::P 
  body: "Request forgery protection is disabled by default in test environment. If you are upgrading from Rails 1.x, add this to config/environments/test.rb:"
- !ruby/struct:SM::Flow::VERB 
  body: "  # Disable request forgery protection in test environment\n  config.action_controller.allow_forgery_protection = false\n"
- !ruby/struct:SM::Flow::H 
  level: 2
  text: Learn more about CSRF (Cross-Site Request Forgery) attacks
- !ruby/struct:SM::Flow::P 
  body: "Here are some resources:"
- !ruby/object:SM::Flow::LIST 
  contents: 
  - !ruby/struct:SM::Flow::LI 
    label: "*"
    body: http://isc.sans.org/diary.html?storyid=1750
  - !ruby/struct:SM::Flow::LI 
    label: "*"
    body: http://en.wikipedia.org/wiki/Cross-site_request_forgery
  type: :BULLET
- !ruby/struct:SM::Flow::P 
  body: "Keep in mind, this is NOT a silver-bullet, plug 'n' play, warm security blanket for your rails application. There are a few guidelines you should follow:"
- !ruby/object:SM::Flow::LIST 
  contents: 
  - !ruby/struct:SM::Flow::LI 
    label: "*"
    body: "Keep your GET requests safe and idempotent. More reading material:"
  - !ruby/object:SM::Flow::LIST 
    contents: 
    - !ruby/struct:SM::Flow::LI 
      label: "*"
      body: http://www.xml.com/pub/a/2002/04/24/deviant.html
    - !ruby/struct:SM::Flow::LI 
      label: "*"
      body: http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.1.1
    type: :BULLET
  - !ruby/struct:SM::Flow::LI 
    label: "*"
    body: "Make sure the session cookies that Rails creates are non-persistent. Check in Firefox and look for &quot;Expires: at end of session&quot;"
  type: :BULLET
constants: []

full_name: ActionController::RequestForgeryProtection::ClassMethods
includes: []

instance_methods: 
- !ruby/object:RI::MethodSummary 
  name: protect_from_forgery
name: ClassMethods
superclass: 
