class Rack::Protection::AuthenticityToken
- Prevented attack
-
CSRF
- Supported browsers
-
all
- More infos
Only accepts unsafe HTTP requests if a given access token matches the token included in the session.
Compatible with Rails and rack-csrf.
Options:
authenticity_param: Defines the param's name that should contain the token on a request.
Public Instance Methods
accepts?(env)
click to toggle source
# File lib/rack/protection/authenticity_token.rb, line 22 def accepts?(env) session = session env token = session[:csrf] ||= session['_csrf_token'] || random_string safe?(env) || env['HTTP_X_CSRF_TOKEN'] == token || Request.new(env).params[options[:authenticity_param]] == token end