Class: Rack::Protection::AuthenticityToken

### Home Classes Methods

### In Files

- lib/rack/protection/authenticity_token.rb

### Parent

Base

### Methods

- #accepts?

### Class/Module Index

Quicksearch

- Rack
- Rack::Protection
- Rack::Protection::AuthenticityToken
- Rack::Protection::Base
- Rack::Protection::EscapedParams
- Rack::Protection::FormToken
- Rack::Protection::FrameOptions
- Rack::Protection::HttpOrigin
- Rack::Protection::IPSpoofing
- Rack::Protection::JsonCsrf
- Rack::Protection::PathTraversal
- Rack::Protection::RemoteReferrer
- Rack::Protection::RemoteToken
- Rack::Protection::SessionHijacking
- Rack::Protection::VERSION
- Rack::Protection::XSSHeader

No matching classes.

# Rack::Protection::AuthenticityToken

Prevented attack | CSRF
Supported browsers | all
More infos | en.wikipedia.org/wiki/Cross-site_request_forgery

Only accepts unsafe HTTP requests if a given access token matches the token included in the session.

Compatible with Rails and rack-csrf.

### Public Instance Methods

accepts?(env) click to toggle source

    # File lib/rack/protection/authenticity_token.rb, line 15
    def accepts?(env)
      return true if safe? env
      session = session env
      token   = session[:csrf] ||= session['_csrf_token'] || random_string
      env['HTTP_X_CSRF_TOKEN'] == token or
        Request.new(env).params['authenticity_token'] == token
    end

[Validate]

Generated with the Darkfish Rdoc Generator 2.